XPCWrappedNative::FlatJSObjectFinalized has the following code (which I noticed while further investigating bug 629610 comment 312): GetScope()->GetWrappedNativeMap()->Remove(this); This seems to be the one of the very few things that manipulates a Native2WrappedNativeMap without acquiring the map lock. (I was noticing because I was comparing the code there to ~XPCWrappedNative, which is very similar, but does acquire the map lock.) The other things (which worry me somewhat less) are: XPCWrappedNativeScope::MarkAllWrappedNativesAndProtos, XPCWrappedNativeScope::ASSERT_NoInterfaceSetsAreMarked, and XPCWrappedNativeScope::SweepAllWrappedNativeTearOffs, which all run under the JSGC_FINALIZE_END callback (though maybe that doesn't really help?). XPCWrappedNativeScope::DebugDump, which is #ifdef DEBUG.
The patch I put in bug 629610 fixes this.