There are functions in mozTelephony and mozBluetooth that convery nsTArrays to JSArrays. The internal machinery moves values to an internal nsTArray that's then tranformed as part of JS_NewArrayObject. There could be a GC sweep during this conversion that could cause some of the values to be swept before rooting.
Hm do we also need a write barrier now with IGC?
Kyle, Gregor: Does this need to block the release?
Nope, this doesn't block release. It's already fixed in 761511 for bluetooth, too.
Created attachment 648098 [details] [diff] [review] Patch 1 (v1): Fix rooting in JSArray creation for mozTelephony
Potential crasher so blocking in case we regress.