FWIW, picking [a random dump](https://crash-stats.mozilla.org/report/index/a663d095-d5c5-4897-8ee7-b7df90210119#tab-rawdump) and cracking it up, I find: ``` 00007FFA78B333A4 48 8B 8E D0 07 00 00 mov rcx,qword ptr [rsi+7D0h] (RSI = 000002C60879A000) 00007FFA78B333AB 48 85 C9 test rcx,rcx (RCX = 0000000004000000) 00007FFA78B333AE 0F 85 20 05 00 00 jne mozilla::net::nsHttpChannel::~nsHttpChannel+9F4h (07FFA78B338D4h) ... 00007FFA78B338D4 mov rax,qword ptr [rcx] **** CRASH ``` `qword ptr [rsi+7D0h]` seems to be [`nsCOMPtr<nsIChannel> mRedirectChannel;`](https://searchfox.org/mozilla-central/rev/c54c71ecbd9e64cafc0df3b596e206ac4072cb91/netwerk/protocol/http/nsHttpChannel.h#568). IIUC this means, that we try to release an invalid smart pointer during [`NS_IMPL_RELEASE(HttpBaseChannel)`](https://hg.mozilla.org/releases/mozilla-release/annotate/7e22d68e1ebfc0839092237feeefad46cfbd8651/netwerk/protocol/http/HttpBaseChannel.cpp#l413). I am only guessing here, but this seems to indicate, that something bad happened to our `nsHttpChannel` object **before** it is [deferred released here](https://hg.mozilla.org/releases/mozilla-release/annotate/7e22d68e1ebfc0839092237feeefad46cfbd8651/dom/bindings/BindingUtils.h#l2721). Is there a time span during which we store something unsafe in the `IncrementalFinalizeRunnable` object such that we can end up with an object already freed elsewhere when we call its release function? Am I misreading all of this?
Bug 1544127 Comment 53 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
FWIW, picking [a random dump](https://crash-stats.mozilla.org/report/index/a663d095-d5c5-4897-8ee7-b7df90210119#tab-rawdump) and cracking it up, I find: ``` 00007FFA78B333A4 48 8B 8E D0 07 00 00 mov rcx,qword ptr [rsi+7D0h] (RSI = 000002C60879A000) 00007FFA78B333AB 48 85 C9 test rcx,rcx (RCX = 0000000004000000) 00007FFA78B333AE 0F 85 20 05 00 00 jne mozilla::net::nsHttpChannel::~nsHttpChannel+9F4h (07FFA78B338D4h) ... 00007FFA78B338D4 mov rax,qword ptr [rcx] **** CRASH ``` `qword ptr [rsi+7D0h]` seems to be [`nsCOMPtr<nsIChannel> mRedirectChannel;`](https://searchfox.org/mozilla-central/rev/c54c71ecbd9e64cafc0df3b596e206ac4072cb91/netwerk/protocol/http/nsHttpChannel.h#568). IIUC this means, that we try to release an invalid smart pointer during [`NS_IMPL_RELEASE(HttpBaseChannel)`](https://hg.mozilla.org/releases/mozilla-release/annotate/7e22d68e1ebfc0839092237feeefad46cfbd8651/netwerk/protocol/http/HttpBaseChannel.cpp#l413). Edit: This is mostly the same as already discussed starting in comment 49.