Pale Moon crash on fiddle-box.com

Talk about code development, features, specific bugs, enhancements, patches, and similar things.
Forum rules
Please keep everything here strictly on-topic.
This board is meant for Pale Moon source code development related subjects only like code snippets, patches, specific bugs, git, the repositories, etc.

This is not for tech support! Please do not post tech support questions in the "Development" board!
Please make sure not to use this board for support questions. Please post issues with specific websites, extensions, etc. in the relevant boards for those topics.

Please keep things on-topic as this forum will be used for reference for Pale Moon development. Expect topics that aren't relevant as such to be moved or deleted.
testuser777

Pale Moon crash on fiddle-box.com

Unread post by testuser777 » 2020-07-31, 20:09

Pale Moon always crashes when I trying to open https://fiddle-box.com/player.html?u=frozza

Pale Moon 28.11.0 (64-bit), running on Windows 7 SP1 x64.
AMD Athlon II X4 620, NVIDIA GeForce GTX 650, 8 GB of RAM.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35474
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: Pale Moon crash

Unread post by Moonchild » 2020-08-01, 09:36

Tested the URL on 28.11.0 x64 on Win 7 SP1 x64: cannot reproduce (no crash).

Please include troubleshooting information and a crash report or if possible a crash dump (see stickies in the General Support board for details)
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

testuser777

Re: Pale Moon crash

Unread post by testuser777 » 2020-08-01, 10:11

Added info in the attachments.
Attachments
palemooncrash.txt
(14.97 KiB) Downloaded 22 times

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35474
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: Pale Moon crash

Unread post by Moonchild » 2020-08-01, 10:33

Please also include the info in help -> troubleshooting information
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
billmcct
Keeps coming back
Keeps coming back
Posts: 954
Joined: 2012-09-04, 15:19
Location: Costa Rica & Union City Georgia USA

Re: Pale Moon crash

Unread post by billmcct » 2020-08-01, 10:38

Crashed for me using 32 bit.

screenshot.13.jpg
screenshot.13.jpg (48.42 KiB) Viewed 589 times
--------------------------------------------------------------------------------------------------------------
The difference between the Impossible and the Possible lies in a man's Determination.
Tommy Lasorda

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35474
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: Pale Moon crash

Unread post by Moonchild » 2020-08-01, 10:49

Crash address is not something straightforward since it seems to be inside the JavaScript garbage collection routine.
A crash minidump providing a stack trace would be very helpful here.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

testuser777

Re: Pale Moon crash

Unread post by testuser777 » 2020-08-01, 12:08

Moonchild wrote:
2020-08-01, 10:33
Please also include the info in help -> troubleshooting information
Here it is.
Application Basics
------------------

Name: Pale Moon
Version: 28.11.0 (64-bit)
Build ID: 20200712011628
Update Channel: release
User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:68.9) Gecko/20100101 Goanna/4.6 Firefox/68.9 PaleMoon/28.11.0
OS: Windows_NT 6.1
Safe Mode: false

Extensions
----------

Name: FoxyProxy Standard
Version: 4.6.5
Enabled: true
ID: foxyproxy@eric.h.jung

Name: Greasemonkey for Pale Moon
Version: 3.31.4
Enabled: true
ID: greasemonkeyforpm@janekptacijarabaci

Name: Guerilla Scripting
Version: 0.0.3.7.5
Enabled: true
ID: guerilla@ketmar.no-ip.org

Name: uBlock Origin
Version: 1.16.4.24
Enabled: true
ID: uBlock0@raymondhill.net

Name: VkOpt
Version: 3.0.7.191215
Enabled: true
ID: vkopt_moz@vkopt.net.ru

Graphics
--------

Features
Compositing: Direct3D 11
GPU Accelerated Windows: 2/2 Direct3D 11 (OMTC)
Asynchronous Pan/Zoom: none
WebGL 1 Driver WSI Info: EGL_VENDOR: Google Inc. (adapter LUID: 000000000000a5c2) EGL_VERSION: 1.4 (ANGLE 2.1.0.) EGL_EXTENSIONS: EGL_EXT_create_context_robustness EGL_ANGLE_d3d_share_handle_client_buffer EGL_ANGLE_surface_d3d_texture_2d_share_handle EGL_ANGLE_query_surface_pointer EGL_ANGLE_window_fixed_size EGL_ANGLE_keyed_mutex EGL_ANGLE_surface_orientation EGL_NV_post_sub_buffer EGL_KHR_create_context EGL_EXT_device_query EGL_KHR_image EGL_KHR_image_base EGL_KHR_gl_texture_2D_image EGL_KHR_gl_texture_cubemap_image EGL_KHR_gl_renderbuffer_image EGL_KHR_get_all_proc_addresses EGL_KHR_stream EGL_KHR_stream_consumer_gltexture EGL_NV_stream_consumer_gltexture_yuv EGL_ANGLE_flexible_surface_compatibility EGL_EXTENSIONS(nullptr): EGL_EXT_client_extensions EGL_EXT_platform_base EGL_EXT_platform_device EGL_ANGLE_platform_angle EGL_ANGLE_platform_angle_d3d EGL_ANGLE_device_creation EGL_ANGLE_device_creation_d3d11 EGL_ANGLE_experimental_present_path EGL_KHR_client_get_all_proc_addresses
WebGL 1 Driver Renderer: Google Inc. -- ANGLE (NVIDIA GeForce GTX 650 Direct3D11 vs_5_0 ps_5_0)
WebGL 1 Driver Version: OpenGL ES 2.0 (ANGLE 2.1.0.)
WebGL 1 Driver Extensions: GL_OES_element_index_uint GL_OES_packed_depth_stencil GL_OES_get_program_binary GL_OES_rgb8_rgba8 GL_EXT_texture_format_BGRA8888 GL_EXT_read_format_bgra GL_NV_pixel_buffer_object GL_OES_mapbuffer GL_EXT_map_buffer_range GL_EXT_color_buffer_half_float GL_OES_texture_half_float GL_OES_texture_half_float_linear GL_OES_texture_float GL_OES_texture_float_linear GL_EXT_texture_rg GL_EXT_texture_compression_dxt1 GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_OES_compressed_ETC1_RGB8_texture GL_EXT_sRGB GL_ANGLE_depth_texture GL_OES_depth32 GL_EXT_texture_storage GL_OES_texture_npot GL_EXT_draw_buffers GL_EXT_texture_filter_anisotropic GL_EXT_occlusion_query_boolean GL_NV_fence GL_EXT_disjoint_timer_query GL_EXT_robustness GL_EXT_blend_minmax GL_ANGLE_framebuffer_blit GL_ANGLE_framebuffer_multisample GL_ANGLE_instanced_arrays GL_ANGLE_pack_reverse_row_order GL_OES_standard_derivatives GL_EXT_shader_texture_lod GL_EXT_frag_depth GL_ANGLE_texture_usage GL_ANGLE_translated_shader_source GL_EXT_discard_framebuffer GL_EXT_debug_marker GL_OES_EGL_image GL_OES_EGL_image_external GL_NV_EGL_stream_consumer_external GL_EXT_unpack_subimage GL_NV_pack_subimage GL_OES_vertex_array_object GL_KHR_debug GL_ANGLE_lossy_etc_decode GL_CHROMIUM_bind_uniform_location GL_CHROMIUM_sync_query GL_CHROMIUM_copy_texture
WebGL 1 Extensions: ANGLE_instanced_arrays EXT_blend_minmax EXT_color_buffer_half_float EXT_frag_depth EXT_shader_texture_lod EXT_texture_filter_anisotropic EXT_disjoint_timer_query MOZ_debug_get OES_element_index_uint OES_standard_derivatives OES_texture_float OES_texture_float_linear OES_texture_half_float OES_texture_half_float_linear OES_vertex_array_object WEBGL_color_buffer_float WEBGL_compressed_texture_etc1 WEBGL_compressed_texture_s3tc WEBGL_debug_renderer_info WEBGL_debug_shaders WEBGL_depth_texture WEBGL_draw_buffers WEBGL_lose_context MOZ_WEBGL_lose_context MOZ_WEBGL_compressed_texture_s3tc MOZ_WEBGL_depth_texture
WebGL 2 Driver WSI Info: EGL_VENDOR: Google Inc. (adapter LUID: 000000000000a5c2) EGL_VERSION: 1.4 (ANGLE 2.1.0.) EGL_EXTENSIONS: EGL_EXT_create_context_robustness EGL_ANGLE_d3d_share_handle_client_buffer EGL_ANGLE_surface_d3d_texture_2d_share_handle EGL_ANGLE_query_surface_pointer EGL_ANGLE_window_fixed_size EGL_ANGLE_keyed_mutex EGL_ANGLE_surface_orientation EGL_NV_post_sub_buffer EGL_KHR_create_context EGL_EXT_device_query EGL_KHR_image EGL_KHR_image_base EGL_KHR_gl_texture_2D_image EGL_KHR_gl_texture_cubemap_image EGL_KHR_gl_renderbuffer_image EGL_KHR_get_all_proc_addresses EGL_KHR_stream EGL_KHR_stream_consumer_gltexture EGL_NV_stream_consumer_gltexture_yuv EGL_ANGLE_flexible_surface_compatibility EGL_EXTENSIONS(nullptr): EGL_EXT_client_extensions EGL_EXT_platform_base EGL_EXT_platform_device EGL_ANGLE_platform_angle EGL_ANGLE_platform_angle_d3d EGL_ANGLE_device_creation EGL_ANGLE_device_creation_d3d11 EGL_ANGLE_experimental_present_path EGL_KHR_client_get_all_proc_addresses
WebGL 2 Driver Renderer: Google Inc. -- ANGLE (NVIDIA GeForce GTX 650 Direct3D11 vs_5_0 ps_5_0)
WebGL 2 Driver Version: OpenGL ES 3.0 (ANGLE 2.1.0.)
WebGL 2 Driver Extensions: GL_OES_element_index_uint GL_OES_packed_depth_stencil GL_OES_get_program_binary GL_OES_rgb8_rgba8 GL_EXT_texture_format_BGRA8888 GL_EXT_read_format_bgra GL_NV_pixel_buffer_object GL_OES_mapbuffer GL_EXT_map_buffer_range GL_EXT_color_buffer_half_float GL_OES_texture_half_float GL_OES_texture_half_float_linear GL_OES_texture_float GL_OES_texture_float_linear GL_EXT_texture_rg GL_EXT_texture_compression_dxt1 GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_OES_compressed_ETC1_RGB8_texture GL_EXT_sRGB GL_ANGLE_depth_texture GL_OES_depth32 GL_EXT_texture_storage GL_OES_texture_npot GL_EXT_draw_buffers GL_EXT_texture_filter_anisotropic GL_EXT_occlusion_query_boolean GL_NV_fence GL_EXT_disjoint_timer_query GL_EXT_robustness GL_EXT_blend_minmax GL_ANGLE_framebuffer_blit GL_ANGLE_framebuffer_multisample GL_ANGLE_instanced_arrays GL_ANGLE_pack_reverse_row_order GL_OES_standard_derivatives GL_EXT_shader_texture_lod GL_EXT_frag_depth GL_ANGLE_texture_usage GL_ANGLE_translated_shader_source GL_EXT_discard_framebuffer GL_EXT_debug_marker GL_OES_EGL_image GL_OES_EGL_image_external GL_OES_EGL_image_external_essl3 GL_NV_EGL_stream_consumer_external GL_EXT_unpack_subimage GL_NV_pack_subimage GL_EXT_color_buffer_float GL_OES_vertex_array_object GL_KHR_debug GL_ANGLE_lossy_etc_decode GL_CHROMIUM_bind_uniform_location GL_CHROMIUM_sync_query GL_CHROMIUM_copy_texture GL_EXT_texture_norm16
WebGL 2 Extensions: EXT_color_buffer_float EXT_texture_filter_anisotropic EXT_disjoint_timer_query MOZ_debug_get OES_texture_float_linear WEBGL_compressed_texture_etc WEBGL_compressed_texture_etc1 WEBGL_compressed_texture_s3tc WEBGL_debug_renderer_info WEBGL_debug_shaders WEBGL_lose_context MOZ_WEBGL_lose_context MOZ_WEBGL_compressed_texture_s3tc
Hardware H264 Decoding: No; DXVA2D3D9 crashes detected in the past
Audio Backend: wasapi
Direct2D: true
DirectWrite: true (6.2.9200.22164)
GPU #1
Active: Yes
Description: NVIDIA GeForce GTX 650
Vendor ID: 0x10de
Device ID: 0x0fc6
Driver Version: 26.21.14.4108
Driver Date: 10-22-2019
Drivers: nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Subsys ID: 00000000
RAM: 1024

Diagnostics
AzureCanvasAccelerated: 0
AzureCanvasBackend: direct2d 1.1
AzureContentBackend: direct2d 1.1
AzureFallbackCanvasBackend: cairo
failures: [GFX1-]: DXVA2D3D9 video decoding is disabled due to a previous crash.

Crash Guard Disabled Features
D3D9 Video Decoder:

Failure Log
(#0) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#16) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#17) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#18) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#19) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#20) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#21) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#22) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#23) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#24) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#25) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#26) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#27) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#28) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#29) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.
(#30) Error: DXVA2D3D9 video decoding is disabled due to a previous crash.

Important Modified Preferences
------------------------------

accessibility.typeaheadfind.flashBar: 0
browser.cache.disk.capacity: 358400
browser.cache.disk.smart_size.first_run: false
browser.cache.disk.smart_size.use_old_max: false
browser.download.folderList: 2
browser.download.importedFromSqlite: true
browser.download.useDownloadDir: true
browser.places.smartBookmarksVersion: 4
browser.search.useDBForOrder: true
browser.startup.homepage: https://.ru/
browser.startup.homepage_override.buildID: 20200712011628
browser.startup.homepage_override.mstone: 4.6.0
extensions.lastAppVersion: 28.11.0
font.internaluseonly.changed: true
general.useragent.override.googlevideos.com: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
general.useragent.override.youtube.com: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
general.useragent.updates.lastupdated: 1596223430818
gfx.crash-guard.d3d11layers.appVersion: 28.11.0
gfx.crash-guard.d3d11layers.deviceID: 0x0fc6
gfx.crash-guard.d3d11layers.driverVersion: 26.21.14.4108
gfx.crash-guard.d3d11layers.feature-d2d: true
gfx.crash-guard.d3d11layers.feature-d3d11: true
gfx.crash-guard.status.d3d11layers: 2
gfx.crash-guard.status.d3d9video: 3
media.benchmark.vp9.fps: 110
media.benchmark.vp9.versioncheck: 3
media.hardware-video-decoding.failed: false
network.cookie.prefsMigrated: true
places.database.lastMaintenance: 1595546605
places.history.expiration.transient_current_max_pages: 120526
privacy.cpd.cookies: false
privacy.cpd.downloads: false
privacy.cpd.formdata: false
privacy.cpd.history: false
privacy.cpd.sessions: false
privacy.donottrackheader.enabled: true
privacy.sanitize.migrateFx3Prefs: true
privacy.sanitize.timeSpan: 0
services.sync.declinedEngines:
services.sync.engine.greasemonkey: true
storage.vacuum.last.index: 1
storage.vacuum.last.places.sqlite: 1595546604

Important Locked Preferences
----------------------------

Places Database
---------------

JavaScript
----------

Incremental GC: true

Accessibility
-------------

Activated: false
Prevent Accessibility: 1

Library Versions
----------------

NSPR
Expected minimum version: 4.24
Version in use: 4.24

NSS
Expected minimum version: 3.48.3
Version in use: 3.48.3

NSSSMIME
Expected minimum version: 3.48.3
Version in use: 3.48.3

NSSSSL
Expected minimum version: 3.48.3
Version in use: 3.48.3

NSSUTIL
Expected minimum version: 3.48.3
Version in use: 3.48.3

User avatar
moonbat
Knows the dark side
Knows the dark side
Posts: 4942
Joined: 2015-12-09, 15:45
Contact:

Re: Pale Moon crash

Unread post by moonbat » 2020-08-01, 12:44

Crashed for me on Linux x64 too.
"One hosts to look them up, one DNS to find them and in the darkness BIND them."

Image
Linux Mint 21 Xfce x64 on HP i5-5200 laptop, 12 GB RAM.
AutoPageColor|PermissionsPlus|PMPlayer|Pure URL|RecordRewind|TextFX

User avatar
adesh
Board Warrior
Board Warrior
Posts: 1277
Joined: 2017-06-06, 07:38

Re: Pale Moon crash

Unread post by adesh » 2020-08-01, 13:25

It crashes for me on the Mac too, but sometimes the page loads successfully. When refreshed, it mostly crashes.
Attachments
Screenshot 2020-08-01 at 6.52.22 PM.png

New Tobin Paradigm

Re: Generic Thread Title

Unread post by New Tobin Paradigm » 2020-08-01, 15:34

Navigator Trunk Win64 build from just now.

Exception thrown: read access violation.
this->shape_.value was 0xFFFFFFFFFFFFFFEF.

Code: Select all

>	xul.dll!js::ModuleObject::importBindings() Line 680	C++
 	xul.dll!js::ModuleEnvironmentObject::lookupProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::MutableHandle<JSObject *> objp, JS::MutableHandle<js::Shape *> propp) Line 527	C++
 	xul.dll!js::LookupProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::MutableHandle<JSObject *> objp, JS::MutableHandle<js::Shape *> propp) Line 2129	C++
 	xul.dll!js::LookupName(JSContext * cx, JS::Handle<js::PropertyName *> name, JS::Handle<JSObject *> envChain, JS::MutableHandle<JSObject *> objp, JS::MutableHandle<JSObject *> pobjp, JS::MutableHandle<js::Shape *> propp) Line 2138	C++
 	xul.dll!GetImportOperation(JSContext * cx, js::InterpreterFrame * fp, unsigned char * pc, JS::MutableHandle<JS::Value> vp) Line 247	C++
 	xul.dll!Interpret(JSContext * cx, js::RunState & state) Line 3168	C++
 	xul.dll!js::RunScript(JSContext * cx, js::RunState & state) Line 420	C++
 	xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 501	C++
 	xul.dll!js::Call(JSContext * cx, JS::Handle<JS::Value> fval, JS::Handle<JS::Value> thisv, const js::AnyInvokeArgs & args, JS::MutableHandle<JS::Value> rval) Line 544	C++
 	xul.dll!PromiseReactionJob(JSContext * cx, unsigned int argc, JS::Value * vp) Line 1022	C++
 	xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 480	C++
 	xul.dll!js::Call(JSContext * cx, JS::Handle<JS::Value> fval, JS::Handle<JS::Value> thisv, const js::AnyInvokeArgs & args, JS::MutableHandle<JS::Value> rval) Line 544	C++
 	xul.dll!JS::Call(JSContext * cx, JS::Handle<JS::Value> thisv, JS::Handle<JS::Value> fval, const JS::HandleValueArray & args, JS::MutableHandle<JS::Value> rval) Line 2877	C++
 	xul.dll!mozilla::dom::LifecycleConnectedCallback::Call(JSContext * cx, JS::Handle<JS::Value> aThisVal, mozilla::ErrorResult & aRv) Line 306	C++
 	xul.dll!mozilla::dom::PromiseJobCallback::Call(const char * aExecutionReason) Line 102	C++
 	xul.dll!PromiseJobRunnable::Run() Line 938	C++
 	xul.dll!mozilla::dom::Promise::PerformMicroTaskCheckpoint() Line 555	C++
 	xul.dll!mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int aRecursionDepth) Line 1393	C++
 	xul.dll!XPCJSContext::AfterProcessTask(unsigned int aNewRecursionDepth) Line 3455	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 1159	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 356	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 96	C++
 	xul.dll!MessageLoop::Run() Line 206	C++
 	xul.dll!nsBaseAppShell::Run() Line 155	C++
 	xul.dll!nsAppShell::Run() Line 264	C++
 	xul.dll!nsAppStartup::Run() Line 284	C++
 	xul.dll!XREMain::XRE_mainRun() Line 3868	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const nsXREAppData * aAppData) Line 3997	C++
 	xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData, unsigned int aFlags) Line 4079	C++
 	borealis.exe!do_main(int argc, char * * argv, char * * envp, nsIFile * xreDirectory) Line 212	C++
 	borealis.exe!wmain(int argc, wchar_t * * argv) Line 111	C++
 	borealis.exe!__scrt_common_main_seh() Line 253	C++
 	kernel32.dll!00000000771b59cd()	Unknown
 	ntdll.dll!000000007741383d()	Unknown
Minidump with symbols: http://repository.binaryoutcast.com/artifacts/dumps/borealis-topic-24923.7z

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35474
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: Pale Moon crash on fiddle-box.com

Unread post by Moonchild » 2020-08-01, 18:44

OK, I got a crash as well with a different location again, but it does point to the general area to look in.
I'm checking if there's a way to catch this on the GC side of things since it may be either a re-entrancy problem or issue with modules being unloaded and swept while still running on a different thread. Either way it's complex, but the crashes seem to be safe since they consistently across applications point to the same OOB address, and it's not a UAF. I did run into a locked BZ bug related to this and have requested access to know what might be going on and to have a better handle on how security sensitive this is beyond my first impression.

Tracking in Issue #1624 (UXP)
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

Locked