Intermittent crash during GC with webgl objects

[jdm]

A release build showed me this confusing stack:

 	simpleservo.dll!_ZN6script3dom11webglbuffer11WebGLBuffer26decrement_attached_counter17h276fc20b88baa23aE�()	Unknown	Symbols loaded.
 	simpleservo.dll!_ZN6script3dom17vertexarrayobject17VertexArrayObject6delete17h2877344cc8a108a4E�()	Unknown	Symbols loaded.
 	simpleservo.dll!_ZN101_$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$9call_once17h033ba6c4f911aec1E�()	Unknown	Symbols loaded.
 	simpleservo.dll!_ZN6script3dom8bindings7codegen8Bindings33WEBGLCompressedTextureS3TCBinding33WEBGLCompressedTextureS3TCBinding4Wrap17h93e96a01f1b4c1a6E�()	Unknown	Symbols loaded.
>	simpleservo.dll!js::gc::Arena::finalize<JSObject>(JSFreeOp * fop, js::gc::AllocKind thingKind, unsigned __int64 thingSize) Line 472	C++	Symbols loaded.
 	simpleservo.dll!FinalizeTypedArenas<JSObject>(JSFreeOp * fop, js::gc::Arena * * src, js::gc::SortedArenaList & dest, js::gc::AllocKind thingKind, js::SliceBudget & budget) Line 531	C++	Symbols loaded.
 	simpleservo.dll!js::gc::ArenaLists::foregroundFinalize(JSFreeOp * fop, js::gc::AllocKind thingKind, js::SliceBudget & sliceBudget, js::gc::SortedArenaList & sweepList) Line 5628	C++	Symbols loaded.
 	simpleservo.dll!js::gc::GCRuntime::finalizeAllocKind(JSFreeOp * fop, js::SliceBudget & budget) Line 5951	C++	Symbols loaded.
 	simpleservo.dll!sweepaction::SweepActionForEach<ContainerIter<mozilla::EnumSet<js::gc::AllocKind,unsigned long long>>,mozilla::EnumSet<js::gc::AllocKind,unsigned long long>>::run(js::gc::SweepAction::Args & args) Line 0	C++	Symbols loaded.
 	simpleservo.dll!sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args & args) Line 0	C++	Symbols loaded.
 	simpleservo.dll!sweepaction::SweepActionForEach<js::gc::SweepGroupZonesIter,JSRuntime *>::run(js::gc::SweepAction::Args & args) Line 6177	C++	Symbols loaded.
 	simpleservo.dll!sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args & args) Line 0	C++	Symbols loaded.
 	simpleservo.dll!sweepaction::SweepActionForEach<js::gc::SweepGroupsIter,JSRuntime *>::run(js::gc::SweepAction::Args & args) Line 0	C++	Symbols loaded.
 	simpleservo.dll!js::gc::GCRuntime::performSweepActions(js::SliceBudget & budget) Line 6310	C++	Symbols loaded.
 	simpleservo.dll!js::gc::GCRuntime::incrementalSlice(js::SliceBudget & budget, const mozilla::Maybe<JSGCInvocationKind> & gckind, JS::GCReason reason, js::gc::AutoGCSession & session) Line 6830	C++	Symbols loaded.

It's not just the old problem of trying to communicate with the webgl thread during a GC after it's been shutdown. This is an actual segfault:

Exception thrown at 0x00007FF960762AF8 (simpleservo.dll) in ServoApp.exe: 0xC0000005: Access violation reading location 0x000001A2E7AA117C.

[jdm]

I saw this after loading https://playground.babylonjs.com/full.html#B922X8#24 and then closing the window after leaving immersive mode.