This is #6 crash for 38.6.0 About 20% of crashes sampled (which have email addresses) cite or have installed the sendlater addon. Although the same user crashed several times in the sample, so a closer examination might reveal a much smaller % of users having the addon. What is causing the other 3/4 of crashes I do not know. But I'll list a few *SENDLATER* examples bp-707d04b2-aea1-4dec-b359-78c2f2160218 (jscm) 0 xul.dll ReleaseObjects xpcom/glue/nsCOMArray.cpp 1 xul.dll nsCOMArray_base::Clear() xpcom/glue/nsCOMArray.cpp 2 xul.dll nsArrayBase::Clear() xpcom/ds/nsArray.cpp 3 xul.dll nsArrayBase::~nsArrayBase() xpcom/ds/nsArray.cpp 4 xul.dll nsArrayCC::`scalar deleting destructor'(unsigned int) 5 xul.dll nsArrayCC::DeleteCycleCollectable() xpcom/ds/nsArray.cpp 6 xul.dll nsArrayCC::cycleCollection::DeleteCycleCollectable(void*) xpcom/ds/nsArray.h 7 xul.dll SnowWhiteKiller::~SnowWhiteKiller() xpcom/base/nsCycleCollector.cpp 8 xul.dll nsCycleCollector::FreeSnowWhite(bool) xpcom/base/nsCycleCollector.cpp 9 xul.dll AsyncFreeSnowWhite::Run() js/xpconnect/src/XPCJSRuntime.cpp 10 kernelbase.dll InitOnceExecuteOnce 11 xul.dll mozilla::HangMonitor::NotifyActivity(mozilla::HangMonitor::ActivityType) xpcom/threads/HangMonitor.cpp 12 mozglue.dll arena_malloc_small memory/mozjemalloc/jemalloc.c 13 mozglue.dll arena_malloc memory/mozjemalloc/jemalloc.c 14 xul.dll js::HashMap<JSAddonId*, nsCOMPtr<nsIAddonInterposition>, js::PointerHasher<JSAddonId*, 3>, js::SystemAllocPolicy>::add<JSAddonId*&, nsIAddonInterposition*&>(js::detail::HashTable<js::HashMapEntry<JSAddonId*, nsCOMPtr<nsIAddonInterposition> >, js::HashMap<JSAddonId*, nsCOMPtr<nsIAddonInterposition>, js::PointerHasher<JSAddonId*, 3>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::AddPtr&, JSAddonId*&, nsIAddonInterposition*&) js/public/HashTable.h 15 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 16 xul.dll nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity(unsigned int, unsigned int) xpcom/glue/nsTArray-inl.h 17 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc bp-ee3afeec-4b4d-4358-b6a9-8ee812160218 (jscm) bp-c8009e0f-0e5a-4c7a-91c5-ee02c2160219 is another bp-b419b9c7-01af-4be7-aec2-8cadb2160213 (andi) other addons, or no addons bp-9b12b7a3-95bb-46e3-abb6-50f2d2160225 mailmerge addon, which uses Outbox bp-30714db0-7391-4164-950d-25de12160217 only calendar addon

Another mailmerge user bp-0a6cde01-cc38-4173-896d-181b22160310, and Thunderbird asked him if he wanted to send remaining messages from the Outbox. no mailmerge or sendlater addon - bp-f19930d5-e8f7-4176-a3cf-5aa972160311

I attempted to find earliest crashes. There's plenty of 38.2.0 crashes. https://crash-stats.mozilla.com/search/?signature=~ReleaseObjects&product=Thunderbird&date=%3C2015-09-10&date=%3E2015-09-01&version=!38.2.0&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports suggests *perhaps* an equally high rate for version 31.* However, it's inclear how many are Outbox related. There's not an obvious correlation standout in https://crash-analysis.mozilla.com/crash_analysis/20150616/20150616_Thunderbird_38.0.1-interesting-modules.txt (including the sendlater addon) The top items are 71% (10/14) vs. 29% (1010/3432) ksuser.dll 71% (10/14) vs. 30% (1017/3432) avrt.dll 57% (8/14) vs. 16% (532/3432) thumbcache.dll 57% (8/14) vs. 19% (649/3432) igd10iumd32.dll 57% (8/14) vs. 19% (650/3432) igdusc32.dll Most crashes contain SnowWhiteKiller. But most, like bp-4a2f5fac-f554-4098-a8ae-e19862160308, don't have a clean stack 0 xul.dll ReleaseObjects xpcom/glue/nsCOMArray.cpp 1 xul.dll nsCOMArray_base::Clear() xpcom/glue/nsCOMArray.cpp 2 xul.dll nsArrayBase::Clear() xpcom/ds/nsArray.cpp 3 xul.dll nsArrayBase::~nsArrayBase() xpcom/ds/nsArray.cpp 4 xul.dll nsArrayCC::`scalar deleting destructor'(unsigned int) 5 xul.dll nsArrayCC::DeleteCycleCollectable() xpcom/ds/nsArray.cpp 6 xul.dll nsArrayCC::cycleCollection::DeleteCycleCollectable(void*) xpcom/ds/nsArray.h 7 xul.dll SnowWhiteKiller::~SnowWhiteKiller() xpcom/base/nsCycleCollector.cpp 8 xul.dll nsCycleCollector::FreeSnowWhite(bool) xpcom/base/nsCycleCollector.cpp 9 xul.dll AsyncFreeSnowWhite::Run() js/xpconnect/src/XPCJSRuntime.cpp 10 user32.dll GetInputBits 11 xul.dll mozilla::HangMonitor::NotifyActivity(mozilla::HangMonitor::ActivityType) xpcom/threads/HangMonitor.cpp 12 xul.dll xul.dll@0x1c6b700 but bp-fd16d955-ba61-4fe7-bd6e-da1762150907 from version 31.7.0 with crash address 0x5a5a5a62 does 0 xul.dll ReleaseObjects xpcom/glue/nsCOMArray.cpp 1 xul.dll nsCOMArray_base::Clear() xpcom/glue/nsCOMArray.cpp 2 xul.dll nsArray::Clear() xpcom/ds/nsArray.cpp 3 xul.dll nsArray::~nsArray() xpcom/ds/nsArray.cpp 4 xul.dll nsArray::`scalar deleting destructor'(unsigned int) 5 xul.dll mozilla::dom::TableRowsCollection::DeleteCycleCollectable() parser/htmlparser/src/nsExpatDriver.cpp 6 xul.dll mozilla::dom::HTMLOptionsCollection::cycleCollection::DeleteCycleCollectable(void*) content/html/content/src/nsDOMStringMap.h 7 xul.dll SnowWhiteKiller::~SnowWhiteKiller() xpcom/base/nsCycleCollector.cpp 8 xul.dll nsCycleCollector::FreeSnowWhite(bool) xpcom/base/nsCycleCollector.cpp 9 xul.dll nsCycleCollector_doDeferredDeletion() xpcom/base/nsCycleCollector.cpp 10 xul.dll AsyncFreeSnowWhite::Run() js/xpconnect/src/XPCJSRuntime.cpp 11 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp Jonathan, the author of the sendlater addon, kindly writes "you're going to see Send Later installed in some of the profiles where the bug manifests. Send Later's use of the Outbox is entirely through supported Thunderbird APIs, so whatever the problem is, it's not Send Later's fault, it's just that Send Later is triggering a bug in Thunderbird core." perhaps a coincidence, but I've encountered at least two people who also crash with nsMsgDBFolder::NotifyItemAdded bug 873426, like bp-83ea0fb5-cd89-465c-88f7-95d0c2151024

Attached are 94 crash comments 7 mention compact 7 mention send and in some cases NOT being able to send 12 mention deleting mail 16 mention archiving didn't attempt to categorize the other 50

#5 crash for version 45.1.0 perhaps this is related to bug 1133892. but I wonder if this is related to filters.

bp-4596423c-f265-4ebb-b67d-617b12160517 "running filters on Inbox" bp-8479a7b9-2848-4fdb-ba9e-7e4b12160521 "Was doing message filters on a large folder." bp-7d77845d-3d8f-449a-b6be-d00cc2160518 "trying to delete messages"

jscm who uses sendlater and reported bp-c8009e0f-0e5a-4c7a-91c5-ee02c2160219, says the crash went away after changing "the ACCOUNT drafts folder from Local Folders (which was not the default) back to the drafts folder in the account". In other words, it was crashing when Drafts was pointing to Local Folders

ReleaseObjects signature is gone in 55.0b2. Perhaps this morphed into a different signature, like bug 1368786. Will need to evaluate 56 beta. It did (and still does) exist in signaficant numbers in 54.0b3.