620592 - Random Crash [@ _purecall | nsRefPtr<nsPluginDestroyRunnable>::nsRefPtr<nsPluginDestroyRunnable>(nsPluginDestroyRunnable*) | nsAutoCompleteController::StartSearch() ]

Status: RESOLVED DUPLICATE of bug 616288

(Toolkit :: Autocomplete, defect)

Description

[Brian Carpenter [:geeknik]]

I have not been able to reproduce this crash at will, however, it has happened twice today, once after starting up the browser and once while typing in a URL after the browser had been open for a while.

http://crash-stats.mozilla.com/report/index/bp-e8a61ea6-d69b-4fc5-9d24-51e072101220

http://crash-stats.mozilla.com/report/index/bp-5bfd5b4b-3d39-4206-a3a5-2254e2101220

Latest nightly built from http://hg.mozilla.org/mozilla-central/rev/fc50c521bf48.

Comment 1

[timeless]

This has nothing to do with plugins, msvc's optimizer will fold lots of constructors/destructors together, what you have is a generic nsRefPtr<>/nsCOMPtr<>

_purecall	obj-firefox/memory/jemalloc/crtsrc/purevirt.c:54
nsRefPtr<x>::nsRefPtr<x>	obj-firefox/dist/include/nsAutoPtr.h:993
nsAutoCompleteController::StartSearch	toolkit/components/autocomplete/src/nsAutoCompleteController.cpp:1022
nsAutoCompleteController::Notify	toolkit/components/autocomplete/src/nsAutoCompleteController.cpp:722
nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:428

the actual line is:
1022    nsCOMPtr<nsIAutoCompleteSearch> search = mSearches[i];

So technically it's nsCOMPtr<nsIAutoCompleteSearch>::nsCOMPtr<nsIAutoCompleteSearch>.

The problem is that mSearches[i] is already *very* unhappy.