So what seems to be going on here is: 1. Cycle collection starts. 2. We unlink the CanvasRenderingContext2D which makes us call SVGObserverUtils::DetachFromCanvasContext as hinted in comment 1, which sets `mContext` to nullptr. [Here's a pernosco link to this moment in step 2](https://pernos.co/debug/gw3A9HI_sgEhYgolYGCgMw/index.html#f{m[Du0q,B1FwcQ_,t[AZk,A1x+_,f{e[Du0q,B1FwcQ_,s{af7NTqlAA,bDU8,uGaOhQQ,oGa9+UQ___/). 3. Cycle collection proceeds to call Unlink() on the `SVGDocument`. 4. As part of that, we call `UnbindFromTree` on the `SVGSVGElement`, and recursively on all of its descendants, including the `SVGFilterElement`. 5. As part of unbinding the filter element, we remove it from the ID table, calling `Document::RemoveFromIdTable`. 6. As part of that removal, we dispatch a `IDTracker::ChangeNotification::ChangeNotification` runnable for the fact that our ID-having-thing has been removed. [Here's a pernosco link to this moment (for the backtrace represented in steps 3-6 here](https://pernos.co/debug/gw3A9HI_sgEhYgolYGCgMw/index.html#f{m[Du0q,B1Ho+w_,t[AZk,A1x+_,f{e[Du0q,B1Ho+w_,s{af7NTqlAA,bDU8,uCEi0Hg,oCHzxHQ___/)). 7. A short time later, that runnable fires with the backtrace shown in comment 0, and we crash because the runnable expects mContext to be non-null. [Here's a pernosco link to this moment (one line before we crash)](https://pernos.co/debug/gw3A9HI_sgEhYgolYGCgMw/index.html#f{m[Du0q,B1Ilhg_,t[AZk,A1x+_,f{e[Du0q,B1Ilgg_,s{af7NTqlAA,bDU8,uGaOhQQ,oGa87YQ___/).
Bug 1758029 Comment 3 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
So what seems to be going on here is: 1. Cycle collection starts. 2. We unlink the CanvasRenderingContext2D which makes us call SVGObserverUtils::DetachFromCanvasContext as hinted in comment 1, which sets `mContext` to nullptr. [Here's a pernosco link to this moment in step 2](https://pernos.co/debug/gw3A9HI_sgEhYgolYGCgMw/index.html#f{m[Du0q,B1FwcQ_,t[AZk,A1x+_,f{e[Du0q,B1FwcQ_,s{af7NTqlAA,bDU8,uGaOhQQ,oGa9+UQ___/). 3. Cycle collection proceeds to call Unlink() on the `SVGDocument`. 4. As part of that, we call `UnbindFromTree` on the `SVGSVGElement`, and recursively on all of its descendants, including the `SVGFilterElement`. 5. As part of unbinding the filter element, we remove it from the ID table, calling `Document::RemoveFromIdTable`. 6. As part of that removal, we dispatch a `IDTracker::ChangeNotification::ChangeNotification` runnable for the fact that our ID-having-thing has been removed. [Here's a pernosco link to this moment (for the backtrace represented in steps 3-6 here)](https://pernos.co/debug/gw3A9HI_sgEhYgolYGCgMw/index.html#f{m[Du0q,B1Ho+w_,t[AZk,A1x+_,f{e[Du0q,B1Ho+w_,s{af7NTqlAA,bDU8,uCEi0Hg,oCHzxHQ___/). 7. A short time later, that runnable fires with the backtrace shown in comment 0, and we crash because the runnable expects mContext to be non-null. [Here's a pernosco link to this moment (one line before we crash)](https://pernos.co/debug/gw3A9HI_sgEhYgolYGCgMw/index.html#f{m[Du0q,B1Ilhg_,t[AZk,A1x+_,f{e[Du0q,B1Ilgg_,s{af7NTqlAA,bDU8,uGaOhQQ,oGa87YQ___/).