CycleCollectedJSRuntime::CycleCollectedJSRuntime calls: JS_SetGrayGCRootsTracer(aCx, TraceGrayJS, this); but then CycleCollectedJSRuntime::Shutdown calls: JS_RemoveExtraGCRootsTracer(cx, TraceGrayJS, this); It seems like the latter attempts to remove something from a different list. I don't actually see a JS_RemoveGrayGCRootsTracer function.
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1369712
Ah, right, I forgot about that quagmire.
You need to log in before you can comment on or make changes to this bug.