Everything is happening on the same thread here. It seems that [`nsTObserverArray<nsAPostRefreshObserver*> mPostRefreshObservers;`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsRefreshDriver.h#634) contains a raw pointer to some `nsAPostRefreshObserver` after that this have been freed during `ManagedPostRefreshObserver::DidRefresh` by removing it from [`mManagedPostRefreshObservers`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsPresContext.h#1258-1259). This raw pointer is used then to unregister the observer in [`ManagedPostRefreshObserver::DidRefresh`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsRefreshObservers.cpp#34) I obviously ignore, if we should expect this object to be still alive in that situation, but from the variable names I would suspect that we miss a timely removal of that instance from `mPostRefreshObservers`. Emilio, I see your name next to some of the most recent changes here, feel free to forward to someone else, of cours.
Bug 1716481 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Everything is happening on the same thread here. It seems that [`nsTObserverArray<nsAPostRefreshObserver*> mPostRefreshObservers;`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsRefreshDriver.h#634) contains a raw pointer to some `nsAPostRefreshObserver` after that this has been freed during `ManagedPostRefreshObserver::DidRefresh` by removing it from [`mManagedPostRefreshObservers`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsPresContext.h#1258-1259). This raw pointer is used then to unregister the observer in [`ManagedPostRefreshObserver::DidRefresh`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsRefreshObservers.cpp#34) I obviously ignore, if we should expect this object to be still alive in that situation, but from the variable names I would suspect that we miss a timely removal of that instance from `mPostRefreshObservers`. Emilio, I see your name next to some of the most recent changes here, feel free to forward to someone else, of cours.
Everything is happening on the same thread here. It seems that [`nsTObserverArray<nsAPostRefreshObserver*> mPostRefreshObservers;`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsRefreshDriver.h#634) contains a raw pointer to some `nsAPostRefreshObserver` after that this has been freed during `ManagedPostRefreshObserver::DidRefresh` by removing it from [`mManagedPostRefreshObservers`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsPresContext.h#1258-1259). This raw pointer is used then to unregister the observer in [`ManagedPostRefreshObserver::DidRefresh`](https://searchfox.org/mozilla-central/rev/d97dca5907e2a0a77a2435b24ef980268cd3c4fe/layout/base/nsRefreshObservers.cpp#34) I obviously ignore, if we should expect this object to be still alive in that situation, but from the variable names I would suspect that we miss a timely removal of that instance from `mPostRefreshObservers`. Emilio, I see your name next to some of the most recent changes here, feel free to forward to someone else, of course.