Bugzilla

So what's going on is the following:

 * We run the `onloadstart` event on the media element (the `<audio>` element on the test-case). That triggers the `go()` function, all good so far.
 * We set the `src` of an `<iframe>`, then call `setAttribute("ondurationchange", "x()")` on the media element.
 * That goes through a doc update which does end up in `Document::MaybeInitializeFinalizeFrameLoaders` (as we have a frame loader to initialize).
 * That ends up calling `nsDocShell::Stop` on the iframe with id="c", which flushes style from `DocLoaderIsEmpty()` in order to figure out whether we're done with loads.
 * That flushes layout on the parent document, as we promote style flushes to layout flushes. That's also ~fine, though not great. The iframe document is `about:blank` at that point. It's a bit unfortunate that setting the src attribute of an `about:blank` iframe flushes the parent document layout, but that's just an observation... Anyhow at that point the stack looks like:

```

Edit: clear because bugzilla tricked me before I finished the comment...