XPCShell's main function has code like: { Rooted<> envobj(cx, ...); ... JS_DestroyContext(cx); } Naturally, when ~envobj fires, |stack| is dead because the cx has been destroyed. This is currently preventing debug builds on tbpl from completing because this crashes when generating the stage packages. Opt builds appear to "work" because we don't poison on free() -- it's just a use-after-free.