Maciej ran into this with what he's working on.
Created attachment 5735 [details] patch to always set the pointer before doing a deref() on the old value
Comment on attachment 5735 [details] patch to always set the pointer before doing a deref() on the old value r=me