Crash report: https://crash-stats.mozilla.org/report/index/060f9fc1-de44-4e61-9a70-44f660210204

Reason: EXC_BAD_INSTRUCTION / EXC_I386_STKFLT
Also reported with EXC_BAD_ACCESS / EXC_I386_GPFLT as this signature.

Top 9 frames of crashing thread:

0 XUL mozilla::wr::RenderThread::UpdateAndRender gfx/webrender_bindings/RenderThread.cpp:535
1 XUL mozilla::wr::RenderThread::HandleFrameOneDoc gfx/webrender_bindings/RenderThread.cpp:327
2 XUL base::WaitableEvent::TimedWait ipc/chromium/src/base/waitable_event_posix.cc:181
3 XUL mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void  xpcom/threads/nsThreadUtils.h:1201
4 XUL MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:548
5 CoreFoundation _CFAutoreleasePoolPop 
6 XUL base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:35
7 XUL MessageLoop::Run ipc/chromium/src/base/message_loop.cc:309
8 XUL base::Thread::ThreadMain ipc/chromium/src/base/thread.cc:191

There is a strange similarity with bug 1690749 in that it also happens on macOS/Intel, started around the same timeframe.

Could the CompositorBridgeParent be dead at the time we run UpdateAndRender?

https://crash-stats.mozilla.org/signature/?signature=mozilla%3A%3Awr%3A%3ARenderThread%3A%3AUpdateAndRender&product=Firefox&date=%3E%3D2021-02-11T22%3A07%3A00.000Z&date=%3C2021-02-18T22%3A07%3A00.000Z&_sort=-date

We are crashing in the call to GetAsyncImagePipelineManager within the same time frame and frequency as bug 1690749, but I'm not seeing it directly related otherwise. It's also unclear how this is macOS-only.
It would help to look at a crash dump and see where the address 0x10993cdb8 is coming from.

Some crash reports has the following stack on compositor thread. It might be related.

WebRenderAPI::~WebRenderAPI()
mozilla::layers::WebRenderBridgeParent::ClearResources()
mozilla::layers::WebRenderBridgeParent::HandleShutdown()

Compositor thread did wait on the following.

• https://searchfox.org/mozilla-central/rev/6f8f3d0e9022b6f0405da26ec940a89455416202/gfx/webrender_bindings/WebRenderAPI.cpp#441

I wonder if there was a case that CompositorBridgeParent was destroyed without calling CompositorBridgeParent::ActorDestroy() nor WebRenderBridgeParent::Destroy(). It seems not happen when CompositorBridgeParent is alive.

Sotaro, I haven't gotten to parse your notes and look into it. If you can take it, please do!

Ok, I take this bug. Though it might be related to Bug 1697579.

Thank you!