Your comment in the linked issue identifies the problem: > Basically I'm wondering if it's safe that JS::GCVector::~GCVector happens after JS_DestroyContext.
It's not safe. The vector (and anything else containing a JS::Heap) must be destroyed before the JS context is destroyed. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to gnome-shell in Ubuntu. https://bugs.launchpad.net/bugs/1974293 Title: gnome-shell crashed on logout with SIGSEGV in js::gc::Cell::storeBuffer() from js::gc::PostWriteBarrierImpl<JSObject>() To manage notifications about this bug go to: https://bugs.launchpad.net/gjs/+bug/1974293/+subscriptions -- desktop-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
