Your comment in the linked issue identifies the problem:
> Basically I'm wondering if it's safe that JS::GCVector::~GCVector happens after JS_DestroyContext.
It's not safe. The vector (and anything else containing a JS::Heap) must be destroyed before the JS context is destroyed.
Your comment in the linked issue identifies the problem:
> Basically I'm wondering if it's safe that JS::GCVector: :~GCVector happens after JS_DestroyContext.
It's not safe. The vector (and anything else containing a JS::Heap) must be destroyed before the JS context is destroyed.