When some request while inserting key into expression index is cancelled (due to database shutdown or by user request) it could lead to bugcheck 300.

  The reason is that IDX_store() holds lock for IRT page when calls BTR_key() and call chain could contain JRD_reschedule() which will throw exception and call CCH_unwind() if attachment (or transaction) was cancelled.
CCH_unwind() will release all page locks and latches and when IDX_store() will try to release IRT page it will trigger bugcheck 300 in CCH\release_bdb().

  The sample call stack when JRD_reschedule() is called :

> fb_inet_server.exe!JRD_reschedule(Jrd::thread_db * tdbb=0x0331f510, long quantum=0, bool punt=true) Line 4070 C++
  fb_inet_server.exe!EVL_expr(Jrd::thread_db * tdbb=0x0331f510, Jrd::jrd_nod * const node=0x0419c468) Line 824 + 0xd bytes C++
  fb_inet_server.exe!BTR_eval_expression(Jrd::thread_db * tdbb=0x0331f510, Jrd::index_desc * idx=0x0331dc80, Jrd::Record * record=0x041c30f8, bool & notNull=true) Line 526 + 0x10 bytes C++
  fb_inet_server.exe!BTR_key(Jrd::thread_db * tdbb=0x0331f510, Jrd::jrd_rel * relation=0x04062110, Jrd::Record * record=0x041c30f8, Jrd::index_desc * idx=0x0331dc80, Jrd::temporary_key * key=0x0331dd3c, Jrd::idx_null_state * null_state=0x00000000, const bool fuzzy=false) Line 1212 + 0x18 bytes C++
  fb_inet_server.exe!IDX_store(Jrd::thread_db * tdbb=0x0331f510, Jrd::record_param * rpb=0x040dc390, Jrd::jrd_tra * transaction=0x040c5fcc, Jrd::jrd_rel * * bad_relation=0x0331ed84, unsigned short * bad_index=0x0331ed90) Line 986 + 0x29 bytes C++

  The main bug is that JRD_reschedule() should not be called if thread holds any LM's lock ! So, bug exists al long as expression indices was enabled.