This one is not obvious. It appears a thread is blocked getting the monitor in nsPipeOutputStream::WriteSegments() while an nsPipeInputStream::AsyncWait() is releasing the monitor. The thread releasing the monitor crashed during the release.
Nathan, this looks like memory corruption. This is the second bug like this I've seen today. (See bug 1142803.) Any thoughts? I don't see how this could happen under normal conditions in pipe.
Did we somehow destroy our pipe while we were waiting on it? That's what comes to mind when things crash on a lock like that. I wish Breakpad would print all the registers...
The nsPipeInputStream::AsyncRead() accesses the monitor through an nsRefPtr<nsPipe>. It seems the nsPipeInputStream itself would have to get destroyed for that to occur. That seems unlikely since nsInputStreamPump::EnsureWaiting() calls AsyncRead() through an nsCOMPtr<>.
If this reproduces I can look at it.
Inactive; closing (see bug 1180138).