Last Comment Bug 877671 - crash in nsEventListenerManager::RemoveEventListener
: crash in nsEventListenerManager::RemoveEventListener
[qa 2013-09-01
: crash, regression, topcrash
Product: Thunderbird
Classification: Client Software
Component: General (show other bugs)
: 17 Branch
: x86 Windows 7
: -- critical (vote)
: Thunderbird 24.0
Assigned To: Olli Pettay [:smaug]
Depends on: 816480
  Show dependency treegraph
Reported: 2013-05-30 08:02 PDT by Wayne Mery (:wsmwk, NI for questions)
Modified: 2013-06-25 06:26 PDT (History)
9 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---

possible patch (1.75 KB, patch)
2013-05-30 10:35 PDT, Olli Pettay [:smaug]
jst: review+
Details | Diff | Splinter Review

Description Wayne Mery (:wsmwk, NI for questions) 2013-05-30 08:02:17 PDT
+++ This bug was initially created as a clone of Bug #816480 +++

still occurs in thunderbird despite fix in Bug #816480. (But firefox crashes are gone)
#11 crash in version 17.0.6

0 	msvcr100.dll 	_VEC_memcpy 	
1 	xul.dll 	nsTArray_base<nsTArrayDefaultAllocator>::ShiftData 	objdir-tb/mozilla/dist/include/nsTArray-inl.h:245
2 	xul.dll 	nsTArray<nsListenerStruct,nsTArrayDefaultAllocator>::RemoveElementsAt 	objdir-tb/mozilla/dist/include/nsTArray.h:946
3 	xul.dll 	nsAutoTObserverArray<nsListenerStruct,2>::RemoveElementAt 	objdir-tb/mozilla/dist/include/nsTObserverArray.h:210
4 	xul.dll 	nsEventListenerManager::RemoveEventListener 	content/events/src/nsEventListenerManager.cpp:414
5 	xul.dll 	nsEventListenerManager::RemoveEventListenerByType 	content/events/src/nsEventListenerManager.cpp:460
6 	xul.dll 	nsWindowRoot::RemoveSystemEventListener 	dom/base/nsGlobalWindow.cpp:7430
7 	xul.dll 	nsXULTooltipListener::DestroyTooltip 	layout/xul/base/src/nsXULTooltipListener.cpp:668
8 	xul.dll 	nsXULTooltipListener::HideTooltip 	layout/xul/base/src/nsXULTooltipListener.cpp:532
9 	xul.dll 	nsXULTooltipListener::~nsXULTooltipListener 	layout/xul/base/src/nsXULTooltipListener.cpp:67
10 	xul.dll 	nsXULTooltipListener::Release 	layout/xul/base/src/nsXULTooltipListener.cpp:76
11 	xul.dll 	nsListenerStruct::~nsListenerStruct 	content/events/src/nsEventListenerManager.h:59
12 	xul.dll 	nsTArray<nsListenerStruct,nsTArrayDefaultAllocator>::DestructRange 	objdir-tb/mozilla/dist/include/nsTArray.h:1225
13 	xul.dll 	nsTArray<nsListenerStruct,nsTArrayDefaultAllocator>::RemoveElementsAt 	objdir-tb/mozilla/dist/include/nsTArray.h:945
14 	xul.dll 	nsAutoTObserverArray<nsListenerStruct,2>::RemoveElementAt 	objdir-tb/mozilla/dist/include/nsTObserverArray.h:210
Comment 1 Olli Pettay [:smaug] 2013-05-30 08:55:24 PDT
That looks like a useful stack.
Comment 2 Olli Pettay [:smaug] 2013-05-30 09:07:41 PDT
Though, the same stack as before
Comment 3 Olli Pettay [:smaug] 2013-05-30 10:35:06 PDT
Created attachment 756066 [details] [diff] [review]
possible patch

I think this could help. Make sure to try to not remove stuff several times.
And use RemoveSystem* since AddSystem* is used too.

hg is broken atm, so can't push to try.
Comment 4 Olli Pettay [:smaug] 2013-05-30 11:37:50 PDT
Comment 6 Phil Ringnalda (:philor) 2013-05-31 21:43:59 PDT
Comment 7 Olli Pettay [:smaug] 2013-06-01 02:21:39 PDT
wsmwk, do we get enough crash-stat data from TB24 to see whether the patch helped?
Comment 8 Wayne Mery (:wsmwk, NI for questions) 2013-06-01 07:03:18 PDT
(In reply to Olli Pettay [:smaug] from comment #7)
> wsmwk, do we get enough crash-stat data from TB24 to see whether the patch
> helped?

not a chance. Not even any happening for 22 beta, or any betas of recent months. But there are users on crash-stats I can attempt to contact.

Note You need to log in before you can comment on or make changes to this bug.