Created attachment 565880 [details]
###!!! ASSERTION: Wrong scope, this is really bad!: 'JS_GetGlobalForObject(cx, obj) == newScope', file content/base/src/nsDocument.cpp, line 3811
In the testcase, |d| is a temporary "about:blank" document, even once |w.document| is the "data:text/html,2" document.
Created attachment 565881 [details]
Can be followed by:
###!!! ASSERTION: Uh, mDocument doesn't match the current inner window document!: '!GetCurrentInnerWindow() || GetCurrentInnerWindow()->GetExtantDocument() == mDocument', file dom/base/nsGlobalWindow.cpp, line 1840
This is fundamentally the same setup as bug 693399.
Bug 693399 landed. When it is made public, it would make sense to land the test case from this bug as a crashtest.
Should now be fixed on mozilla-central. Still leaving the bug open until the test lands (might as well, we have bug 693399 for the test)
> Still leaving the bug open until the test lands
Please don't do that. It breaks stats and after-fix.
This bug appears to affect 3.6.x
Verified on recent Fx10 and Fx11 debug builds. Prior to the fix running the test case would show an assertion in the shell, but on the recent builds only a warning appears.
Verified fixed in debug trunk.
Verified fixed in debug Firefox 10.0.5esrpre 2012-05-31.