Created attachment 569888 [details] stack trace (debug) (Opt: bp-e8b730d4-a820-409a-ad90-ccfae2111026)
HTMLOptionsCollectionWrapper::setItemAt has: return NS_SUCCEEDED(rv) ? true : Throw(nsnull, rv); but Throw() does XPCThrower::Throw(rv, cx); which does JS_IsExceptionPending(cx) which dereferences cx. Peter, can we just pass in a JSContext to setItemAt? The only caller seems to have a JSContext.
That's what generates the code in question, yes.
Created attachment 570078 [details] [diff] [review] v1
Comment on attachment 570078 [details] [diff] [review] v1 Ideally we'd throw when unwrapping, for that we should probably sprinkle more builtinclass around. But we need to deal correctly with errors from setItemAt anyway.
Comment on attachment 570078 [details] [diff] [review] v1 r=me