Because they use UnwrapProxy but that assumes the private slot is a private value, whereas ~BindingJSObjectCreator will have set it to undefined.
Created attachment 8566636 [details] [diff] [review] DOM proxy finalizers should not assume that the JS object has an actual reference to the DOM object (and in particular that the slot it's stored in is a private slot)
Attachment #8566636 - Flags: review?(peterv)
Attachment #8566636 - Flags: review?(peterv) → review+
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox39: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla39
You need to log in before you can comment on or make changes to this bug.