564939 - Invalid read of size 8 in nsDocShellTreeOwner::RemoveChromeListeners()

Status: RESOLVED DUPLICATE of bug 561457

(Core :: IPC, defect)

Description

[Doug Turner (:dougt)]

During shutdown of fennec on linux desktop qt:

==4560== Invalid read of size 8
==4560==    at 0x69736C5: nsDocShellTreeOwner::RemoveChromeListeners() (nsDocShellTreeOwner.cpp:917)
==4560==    by 0x6972B2B: nsDocShellTreeOwner::WebBrowser(nsWebBrowser*) (nsDocShellTreeOwner.cpp:768)
==4560==    by 0x6979CAC: nsWebBrowser::InternalDestroy() (nsWebBrowser.cpp:144)
==4560==    by 0x697F27B: nsWebBrowser::Destroy() (nsWebBrowser.cpp:1248)
==4560==    by 0x6D6E5DF: mozilla::dom::TabChild::destroyWidget() (TabChild.cpp:361)
==4560==    by 0x6D6EA84: mozilla::dom::TabChild::~TabChild() (TabChild.cpp:368)
==4560==    by 0x6D6DDEE: mozilla::dom::TabChild::Release() (TabChild.cpp:140)
==4560==    by 0x6D692F5: mozilla::dom::ContentProcessChild::DeallocPIFrameEmbedding(mozilla::dom::PIFrameEmbeddin\
gChild*) (ContentProcessChild.cpp:100)
==4560==    by 0x6E4A94F: mozilla::dom::PContentProcessChild::RemoveManagee(int, mozilla::ipc::RPCChannel::RPCList\
ener*) (PContentProcessChild.cpp:433)
==4560==    by 0x6E4F534: mozilla::dom::PIFrameEmbeddingChild::OnMessageReceived(IPC::Message const&) (PIFrameEmbe\
ddingChild.cpp:524)
==4560==    by 0x6E49F18: mozilla::dom::PContentProcessChild::OnMessageReceived(IPC::Message const&) (PContentProc\
essChild.cpp:196)
==4560==    by 0x6D92A02: mozilla::ipc::AsyncChannel::OnDispatchMessage(IPC::Message const&) (AsyncChannel.cpp:262\
)
==4560==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==4560==