39846 - Crashes at nsMsgComposeAndSend::DeleteListeners

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect, P3)

Description

[Shiva Thirumazhusai]

Generally in Composing HTML mail.

One of the Top Crashes in Talkback System.

Stack Trace :-

nsMsgComposeAndSend::DeleteListeners 
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 3156] 
nsMsgComposeAndSend::Clear 
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 357] 
nsMsgComposeAndSend::~nsMsgComposeAndSend 
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 216] 
nsMsgComposeAndSend::`scalar deleting destructor' 
nsMsgComposeAndSend::Release 
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 157] 
MailDeliveryCallback 
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 2597] 
nsMsgDeliveryListener::OnStopRunningUrl 
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgDeliveryListener.cpp, 
line 83] 

Code Around the Crash :-

  nsresult
3146                 nsMsgComposeAndSend::DeleteListeners()
3147                 {
3148                   if ( (mListenerArray) && (*mListenerArray) )
3149                   {
3150                     PRInt32 i;
3151                     for (i=0; i<mListenerArrayCount; i++)
3152                     {
3153 sspitzer  1.186       NS_IF_RELEASE(mListenerArray[i]);
3154 rhp       1.67      }
3155                     
3156                     PR_FREEIF(mListenerArray);
3157                   }
3158                 
3159                   mListenerArrayCount = 0;
3160                   return NS_OK;
3161                 }

Comment 1

[Shiva Thirumazhusai]

Added keywords crash and topcrash.

Comment 2

[Jean-Francois Ducarroz]

Reassign to rhp.

Comment 3

[rhp (gone)]

This is actually a problem that has been fixed by a checkin of jefft's 
yesterday. For a while, we had a situation where OnStop...() handlers were 
being called more than once on send/copy operations. This would have us calling 
the DeleteListeners() method more than once which could cause bad things to 
happen.

- rhp

Comment 4

[lchiang]

rhp - around what areas would cause this crash?  (ie. what actions?)

Comment 5

[rhp (gone)]

This was a problem with an OnStop listener method getting called twice. It was 
fixed there. It happened pretty often.

- rhp

Comment 6

[fenella]

The bug is long gone. win32 (2001-07-11-06-0.9.2)