Windows XP
XPCCallContext::~XPCCallContext is still wiping out newborn roots causing crashes under [@ js_FinalizeObject] because AllocSlots is calling gc and causing its caller (js_NewObject)'s obj to be destroyed before it's stable
XPConnect