In Frame 5 I see:
unsigned long mozilla::dom::ServiceWorkerResolveWindowPromiseOnRegisterCallback::Release()
which causes a
delete (this) of
NS_INLINE_DECL_REFCOUNTING_WITH_DESTROY(_class, delete (this), __VA_ARGS__)).
ServiceWorkerResolveWindowPromiseOnRegisterCallback contains a
RefPtr<ServiceWorkerRegistrationPromise::Private> mPromise;, which seems to be the last counted reference to this instance. During destruction, thus also the
ServiceWorkerRegistrationPromise::Private gets destroyed in a moment it did not expect to be destroyed, it seems. As in this case probably no one expects this promise to be resolved any more, we might want to handle this edge case and do something in
~ServiceWorkerResolveWindowPromiseOnRegisterCallback() if we are owning the last reference to the promise, at least as a fallback. We still might want to understand, if there is an order problem during shutdown, though.
Side note on Frame 6:
void nsTArray_Impl<RefPtr<ID3D11RenderTargetView>, nsTArrayInfallibleAllocator>::~nsTArray_Impl()
Where does ID3D11RenderTargetView (MS Direct3D class) come from? The array that most probably has been destroyed in frame 7 should be
nsTArray<RefPtr<Callback>> mResultCallbackList; in ServiceWorkerJob which would match perfectly the
ServiceWorkerResolveWindowPromiseOnRegisterCallback::Release() call of frame 5.