The #1 trunk topcrash is currently in nsViewManager's destructor, during XPCOM shutdown; typically like: nsViewManager::~nsViewManager() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp line 848] nsViewManager::Release() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp line 288] nsEditor::~nsEditor() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/base/nsEditor.cpp line 246] nsPlaintextEditor::~nsPlaintextEditor() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp line 111] nsEditor::Release() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/base/nsEditor.cpp line 248] XPCJSRuntime::GCCallback() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcjsruntime.cpp line 562] DOMGCCallback() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp line 2205] js_GC() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsgc.c line 2033] js_ForceGC() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsgc.c line 1561] js_DestroyContext() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jscntxt.c line 283] JS_DestroyContext() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/jsapi.c line 934] mozJSComponentLoader::UnloadModules() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp line 1174] mozJSComponentLoader::Observe() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp line 1197] NS_ShutdownXPCOM_P() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/build/nsXPComInit.cpp line 848] ScopedXPCOMStartup::~ScopedXPCOMStartup() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp line 556] XRE_main() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp line 848] main() [/builds/tinderbox/Fx-Trunk/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp line 62] My guess is that eventQueue is null; but we already have all the relevant event queues; why not just use them instead?

See also bug 319999 comment 11.

Comment on attachment 212241 [details] [diff] [review] possible patch This looks good to me.

Checked in to trunk.

NOTE: There are several other places in layout that have similar code in object destructors to call RevokeEvents. I think many of them also go through the EQS to get the current thread's event queue.

Yep, see comment 2.