1. Get a trunk nightly. 2. Create a use a new profile. 3. Set offline.startup.state to 1. 4. Quit and restart using this profile. 5. Select either offline or online upon request (doesn't matter). 6. Observe segfault. This started happening 2 days ago, and TB16000051Z points to bug 326491 as the culprit, which fits in with the timeframe and mooment of crash.

Stack isn't that useful, the line numbers are all wrong. I'm on paternity leave for two weeks starting today; can somebody post a stack from a debug build with better debugging info?

my guess is that the list is changing out from under us, even though we're going backwards through the list...But when I started debugging, the crash went away and my fastload cache seemed to be corrupted. I'll try again on this machine.

I'm beginning to think that the observerList coming from mObserverTopicTable is horked. Sometimes mHdr is null, which should not be possible with an nsTArray. Unfortunately, Purify doesn't like vc8 builds, from what I can tell, so it's hard to tell what's going on.

Dammit, I bet I know what's going on: I added the comment here: http://lxr.mozilla.org/mozilla/source/xpcom/ds/nsObserverList.h#97 at Darin's request, but the callback func here: http://lxr.mozilla.org/mozilla/source/xpcom/ds/nsObserverList.cpp#137 Disobeys the invariant. I suggest backing out bug 326491 because the NotifyObservers() impl is going to need work.

backed out patch for bug 326491 to fix this bug.

*** Bug 330322 has been marked as a duplicate of this bug. ***