User list keeps increasing if client is running for too long; crash when closing

[XPJ38]

Hexchat 2.9.6 x64
Visual C++ 2012 Redistributable x64 11.0.60610
Windows 7 SP1 x64

Server: cho.ppy.sh (needs server password; nickname is linked to an account on the server's website)
Main channel #osu always has between 5,000 and 13,000 users connected.

Problem:
If Hexchat is running for several hours, user list will start acting weird. Number of users connected will keep increasing, duplicates will appear and list won't be sorted properly (screenshots below). Closing Hexchat will lead to an APPCRASH (details below). Memory leak maybe?
It works just fine for the first 4-5 hours though, it's only after that that it begins to act weird.
Problem occurs on every channel joined.
I can't try on other PCs since I have only one :<

How to connect, if you wish to replicate:
Create an account here: http://osu.ppy.sh/ (website distributes an online rhythm game called osu! and has more than 3m registered accounts)
Follow instructions here: http://osu.ppy.sh/wiki/IRC

Screenshots:

• Client has been running for about 8 hours (notice sorting in user list and total number of users):

• Client is closed and crashes:

• Client is restarted (compare total number of users with 1st screenshot):

Appcrash detail (in French, sorry):
Signature du problème :
Nom d’événement de problème: APPCRASH
Nom de l’application: hexchat.exe
Version de l’application: 2.9.6.0
Horodatage de l’application: 5235cd5d
Nom du module par défaut: StackHash_e771
Version du module par défaut: 6.1.7601.18247
Horodateur du module par défaut: 521eaf24
Code de l’exception: c0000374
Décalage de l’exception: 00000000000c4102
Version du système: 6.1.7601.2.1.0.256.48
Identificateur de paramètres régionaux: 1036
Information supplémentaire n° 1: e771
Information supplémentaire n° 2: e771a053837803289e19bb3948bc160f
Information supplémentaire n° 3: 33b2
Information supplémentaire n° 4: 33b2e042db3584966814bc8465c0a7a2

Btw website says that 2.9.6.1 is available but installer installs 2.9.6. Is it intended?

---

Want to back this issue? Place a bounty on it! We accept bounties via Bountysource.

[TingPing]

Ok well I am connected so we will see how it goes, everything seems to be working fine so far.

Btw website says that 2.9.6.1 is available but installer installs 2.9.6. Is it intended?

Yes.

[TingPing]

I've confirmed the crash, it happens when freeing a user it doesn't like.

Related: https://bugzilla.redhat.com/show_bug.cgi?id=959556

[XPJ38]

Ok, good to see that the bug is known.
According to your link, it seems to impact only the x64 version. Might as well switch to x86 in the meantime?

[TingPing]

I would assume it affects both.

[XPJ38]

Heh, I'll just wait for it to get fixed then. Thanks.

[Arnavion]

Possibly related stack trace from #893 (64-bit HC / W8):

Unhandled exception at 0x00007FF72681D6FA in hexchat.exe: 0xC0000005: Access violation reading location 0x0000003386908F68.

Autos:
        access1 0   unsigned int
+       serv    0x00000033f73c24b0 {connect=0x00007ff72680f720 {hexchat.exe!server_connect(server *, char *, int, int)} ...}    server *
+       user1   0x0000003380974110 {nick=0x0000003380974110 "Sky_Fan" hostname=0x0000003380974050 "cho@ppy.sh" realname=...}    User *
        user1->access   0   unsigned int
+       user2   0x0000003386908f00 {nick=0x0000003386908f00 <Error reading characters of string.> hostname=??? realname=...}    User *

^ user2 does not point to anything so user2->access is throwing the exception at **userlist.c:36**

Call Stack:
>   hexchat.exe!nick_cmp_az_ops(server * serv, User * user1, User * user2) Line 36  C
    hexchat.exe!mybsearch(const void * key, void * * array, unsigned __int64 nmemb, int (const void *, const void *, void *) * compar, void * data, int * pos) Line 149 C
    hexchat.exe!tree_remove(_tree * t, void * key, int * pos) Line 193  C
    hexchat.exe!userlist_remove_user(session * sess, User * user) Line 384  C
    hexchat.exe!inbound_quit(server * serv, char * nick, char * ip, char * reason, const message_tags_data * tags_data) Line 842    C
    hexchat.exe!process_named_msg(session * sess, char * type, char * * word, char * * word_eol, const message_tags_data * tags_data) Line 1114 C
    hexchat.exe!irc_inline(server * serv, char * buf, int len) Line 1559    C
    hexchat.exe!server_inline(server * serv, char * line, int len) Line 405 C
    hexchat.exe!server_read(_GIOChannel * source, GIOCondition condition, server * serv) Line 471   C
    glib-2.0.dll!g_main_dispatch(_GMainContext * context) Line 3056 C
    glib-2.0.dll!g_main_context_iterate(_GMainContext * context, int block, int dispatch, _GThread * self) Line 3701    C
    glib-2.0.dll!g_main_loop_run(_GMainLoop * loop) Line 3895   C
    gtk-win32-2.0.dll!gtk_main() Line 1258  C
    hexchat.exe!fe_main() Line 314  C
    hexchat.exe!main(int argc, char * * argv) Line 1151 C
    [External Code] 

Version: 2.9.6
Compiled: Feb 5 2014
Portable Mode: No
Build Type: x64
OS: Windows 8

[TingPing]

@XPJ38 This is a bit late, but if you still use and encounter this can you try setting Preferences > userlist > usrlist sorted by to A-Z (then restart client)

[esibun]

I've since noticed this only happens on 64-bit so I switched to 32-bit
builds.

On Tue Dec 30 2014 at 3:34:13 AM TingPing notifications@github.com wrote:

@XPJ38 https://github.com/XPJ38 This is a bit late, but if you still
use and encounter this can you try setting Preferences > userlist >
usrlist sorted by to A-Z

—
Reply to this email directly or view it on GitHub
#818 (comment).

[TingPing]

I've since noticed this only happens on 64-bit so I switched to 32-bit
builds.

Hmm that doesn't really make sense.