I had to add code to manually restore the flag at every cycle collection. https://bugzilla.mozilla.org/show_bug.cgi?id=584495 An assert in JSAPI could reveal where the flag is lost.

Not an assertion, that'll just screw users again if you commit it before fixing. Since it seems hard to repro, would a warning suffice? /be

I will just tryserver it till kingdom come. Maybe I catch it there.

I'm not sure if this is still an issue, but I'm getting an assertion that seems related. It's here: void XPCJSRuntime::TraceXPConnectRoots(JSTracer *trc) { ... JS_ASSERT(acx->hasRunOption(JSOPTION_UNROOTED_GLOBAL)); } The place where the option gets unset is here: ContextHolder::ContextHolder(JSContext *aOuterCx, JSObject *aSandbox) { ... JS_SetOptions(mJSContext, JSOPTION_DONT_REPORT_UNCAUGHT | JSOPTION_PRIVATE_IS_NSISUPPORTS); } Would it be correct just to add JSOPTION_UNROOTED_GLOBAL to this list? Note that I'm doing some weird stuff here where I'm calling a non-GC tracer at an unusual time. But it still seems like the code is wrong as it stands. Or else maybe the assertion is wrong?

JSOPTION_UNROOTED_GLOBAL was removed in https://hg.mozilla.org/mozilla-central/rev/efae8cc0fff8. Resolving as WFM.