Stray timer may be registered by SIP TCP and TLS transport in destroy routine, which could crash the program on Symbian (thanks Tamàs Solymosi for the report)

[bennylp]

When TCP/TLS transport is being destroyed, they cancel all pending transmissions on the transport. This cancellation may in turn cause pjsip_transport_dec_ref() to be called, which may register an (stray) idle timer for the transport. Since the transport pool will be released right after that, the timer entry pointer will be invalid and it will crash the program if the timer heap is trying to access the entry.

This scenario could only happen during program shutdown sequence, as the (hard) destroy routine must not be called on normal situation (the graceful shutdown must be called instead), and this only matters in Symbian since only Symbian timer heap has stray timer cleanup routine, and only if ticket #1035 is not applied.

[bennylp]

Fixed in r3077