nsHTMLCanvasElement::GetContext creates a hash property bag to convert its context options into an nsIProperties object. Unfortunately a hash property bag has inherits multiply from nsIProperties and the wrong one gets put in the second nsCOMPtr. (I'm not sure why it uses two nsCOMPtrs in the first place.)
I've been meaning to file this for some time, thanks for doing that.
Created attachment 559410 [details] [diff] [review] Proposed patch
Comment on attachment 559410 [details] [diff] [review] Proposed patch Looks fine to me. Benoit should probably look, but I think it's fine for his review to come after landing.
Pushed changeset cb79942d0feb to mozilla-central.
Sorry, I should have said changeset afe75f8431ad of course.
Comment on attachment 559410 [details] [diff] [review] Proposed patch I'm not a good reviewer for this code.