crash in nsEventListenerManager::RemoveEventListener

RESOLVED FIXED in Thunderbird 24.0

Status

Thunderbird
General
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: wsmwk, Assigned: smaug)

Tracking

({crash, regression, topcrash})

17 Branch
Thunderbird 24.0
x86
Windows 7
crash, regression, topcrash

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [qa 2013-09-01, crash signature)

Attachments

(1 attachment)

+++ This bug was initially created as a clone of Bug #816480 +++

still occurs in thunderbird despite fix in Bug #816480. (But firefox crashes are gone)
#11 crash in version 17.0.6

bp-ebc5f105-6bbc-4abb-9dad-7513e2130529
0 	msvcr100.dll 	_VEC_memcpy 	
1 	xul.dll 	nsTArray_base<nsTArrayDefaultAllocator>::ShiftData 	objdir-tb/mozilla/dist/include/nsTArray-inl.h:245
2 	xul.dll 	nsTArray<nsListenerStruct,nsTArrayDefaultAllocator>::RemoveElementsAt 	objdir-tb/mozilla/dist/include/nsTArray.h:946
3 	xul.dll 	nsAutoTObserverArray<nsListenerStruct,2>::RemoveElementAt 	objdir-tb/mozilla/dist/include/nsTObserverArray.h:210
4 	xul.dll 	nsEventListenerManager::RemoveEventListener 	content/events/src/nsEventListenerManager.cpp:414
5 	xul.dll 	nsEventListenerManager::RemoveEventListenerByType 	content/events/src/nsEventListenerManager.cpp:460
6 	xul.dll 	nsWindowRoot::RemoveSystemEventListener 	dom/base/nsGlobalWindow.cpp:7430
7 	xul.dll 	nsXULTooltipListener::DestroyTooltip 	layout/xul/base/src/nsXULTooltipListener.cpp:668
8 	xul.dll 	nsXULTooltipListener::HideTooltip 	layout/xul/base/src/nsXULTooltipListener.cpp:532
9 	xul.dll 	nsXULTooltipListener::~nsXULTooltipListener 	layout/xul/base/src/nsXULTooltipListener.cpp:67
10 	xul.dll 	nsXULTooltipListener::Release 	layout/xul/base/src/nsXULTooltipListener.cpp:76
11 	xul.dll 	nsListenerStruct::~nsListenerStruct 	content/events/src/nsEventListenerManager.h:59
12 	xul.dll 	nsTArray<nsListenerStruct,nsTArrayDefaultAllocator>::DestructRange 	objdir-tb/mozilla/dist/include/nsTArray.h:1225
13 	xul.dll 	nsTArray<nsListenerStruct,nsTArrayDefaultAllocator>::RemoveElementsAt 	objdir-tb/mozilla/dist/include/nsTArray.h:945
14 	xul.dll 	nsAutoTObserverArray<nsListenerStruct,2>::RemoveElementAt 	objdir-tb/mozilla/dist/include/nsTObserverArray.h:210
(Assignee)

Comment 1

4 years ago
That looks like a useful stack.
Assignee: nobody → bugs

Updated

4 years ago
OS: Windows NT → Windows 7
Version: 0.9 → 17
(Assignee)

Comment 2

4 years ago
Though, the same stack as before
(Assignee)

Comment 3

4 years ago
Created attachment 756066 [details] [diff] [review]
possible patch

I think this could help. Make sure to try to not remove stuff several times.
And use RemoveSystem* since AddSystem* is used too.

hg is broken atm, so can't push to try.
Attachment #756066 - Flags: review?(jst)
(Assignee)

Comment 4

4 years ago
https://tbpl.mozilla.org/?tree=Try&rev=9191bf943ff3

Updated

4 years ago
Attachment #756066 - Flags: review?(jst) → review+
(Assignee)

Comment 5

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/736f813b9892
https://hg.mozilla.org/mozilla-central/rev/736f813b9892
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → Thunderbird 24.0
(Assignee)

Comment 7

4 years ago
wsmwk, do we get enough crash-stat data from TB24 to see whether the patch helped?
(In reply to Olli Pettay [:smaug] from comment #7)
> wsmwk, do we get enough crash-stat data from TB24 to see whether the patch
> helped?

not a chance. Not even any happening for 22 beta, or any betas of recent months. But there are users on crash-stats I can attempt to contact.
(Reporter)

Updated

4 years ago
Whiteboard: [tbird topcrash] → [qa 2013-09-01
You need to log in before you can comment on or make changes to this bug.