This does not crash when dom.security.https_first is set to the default value of false.
Bug 1809003 Comment 9 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
The STR in comment 7 don't crash when dom.security.https_first is set to the default value of false.