Ah, so the allocator can be deleted when there are no nsTimerEvent objects left. And the counter is decreased in dtor of nsTimerEvent, so the object is still alive at that point. Another thread then deletes the allocator.
Bug 1724107 Comment 3 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Ah, so the allocator can be deleted when there are no nsTimerEvent objects left. And the counter is decreased in dtor of nsTimerEvent, so the object is still alive at that point. Another thread then deletes the allocator. I guess the counter should be decreased later, maybe after https://searchfox.org/mozilla-central/rev/00977c4e37865a92f1c15572ae4aea90e934b25b/xpcom/threads/TimerThread.cpp#151