First reported by JoeS in the forums. View a news article with several images in it. We eventually crash. The stack looks kind of bogus to me: > nsAutoRefCnt::operator unsigned long() Line 210 C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++ nsSupportsArray::RemoveElementsAt() Line 469 C++ nsSupportsArray::RemoveElementAt() Line 124 C++ nsSupportsArray::RemoveElement() Line 486 C++ nsSupportsArray::RemoveElement() Line 87 C++ nsMsgDatabase::RemoveListener() Line 575 C++ nsMsgDBFolder::Shutdown() Line 223 C++ nsMsgDBFolder::~nsMsgDBFolder() Line 216 C++ nsMsgDBFolder::`scalar deleting destructor'() C++ nsRDFResource::Release() Line 78 C++ nsMsgDBFolder::Release() Line 142 C++

I saw this by going to: mozilla.test.multimedia look for the thread titled new, new, everything new;-) click around some of those articles and eventually you'll see it.

FYI, this is on the trunk.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007071212 Thunderbird/3.0a1pre ID:2007071212 seems to work fine. With the recent problems on trunk, might be hard to narrow the regression range.

This is a ref-counting problem, more specifically, an undercounting problem, so that objects are getting deleted when they shouldn't. My first guess would be the recent news changes to handle certain kinds of uri's, but that's just a guess.

David if you think it is uri related... maybe # 388281

my guess was bug 128297

maybe this code in nsNntpService::DecomposeNewsMessageURI needs an addref: + nsCOMPtr <nsIMsgFolder> folder = do_QueryInterface(child, &rv); + NS_ENSURE_SUCCESS(rv,rv); + + *aFolder = folder; + *aMsgKey = key; I'll give it a try.

fixed, trunk-only issue.

Hourly should have had your patch. Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007072105 Thunderbird/3.0a1pre ID:2007072105 No joy here..I see the same problem.

maybe you could try tomorrow's nightly build - I don't really know what the timestamp on the "hourly" build is.

Yep Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007072204 Thunderbird/3.0a1pre ID:2007072204 Works fine, must have missed the hourly that I tried. Thanks David.

great, thx for verifying, Joe.