Steps To Reproduce: 1. Enable chrome privileged (i.e. devtools.chrome.enabled= true) 2. Open ScratchPad (Shift+F4) 3. Open about:home 4. Run the following code in chrome privilege: content.document.getElementById("searchText").value=""; ---- Nothing happens as expected 5. Keyin text into input field of about:home 6. Run again Actual Results: Tab crashed bp-0bfa49c5-9a65-4846-bf5a-7dd332140731 Expected Results: No Crash. The field become empty.

[@ mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) ]

This is the content process crashing with the assertion: > sync messages forbidden while handling urgent message It looks like the parent sends a CPOW to the child, which invokes: HTMLInputElement::SetValue -> IMEStateManager::UpdateIMEState -> PuppetWidget::GetInputContext -> PBrowserChild::SendGetInputContext ... Which is a sync message, being triggered by a CPOW

no longer crash.

After landing Bug 1051017 , name of property changed. So, Now, following statement will crash the tab silently(no crash reports). window.gBrowser.selectedBrowser.contentDocumentAsCPOW.getElementById("searchText").value="" Steps To Eeproduce: 1. Enable chrome privileged (i.e. devtools.chrome.enabled= true) 2. Open ScratchPad (Shift+F4) 3. Open about:home 4. Keyin text into input field of about:home 5. Run the following code in chrome privilege: window.gBrowser.selectedBrowser.contentDocumentAsCPOW.getElementById("searchText").value="" 6. Run

This is currently the second most popular content crash so might need to be a higher priority.