Link to crash report: https://crash-stats.mozilla.com/report/index/34f95538-6832-4a5c-a280-ee23e2140516 I don't have much more than that, let me know if you need anything else.
Testcases are always useful.
...but I'll write one.
Except that I can't seem to reproduce this. Changing the value of an input element inside shadow root works just fine here. Kevin, do you recall how you got the crash? c-s.m.c doesn't seem to link to right lines of code :(
I just checked, and I am no longer crashing - yaay. I suppose something else fixed this. I am however having a hard time focusing on text inputs in the shadow root. Seems like another bug though.
Yeah, focus handling is another bug (Bug 1026164) which I'm just looking at.