This was caught while add more assertion to actors' event targets when fixing Bug 1328517. IToplevelProtocol::Register(aRouted) will try to set EventTarget of aRouted from its manager. However, aRouted's manager was set after Register is called: http://searchfox.org/mozilla-central/rev/afcf40f3eafd895611a839017730debb58a342a6/ipc/ipdl/ipdl/lower.py#3807-3808 I'll upload a patch to address this.

Please see the explanation in comment 0.

Comment on attachment 8835898 [details] [diff] [review] Patch: SetManager in prior to Register to Inherit EventTarget from Manager. Review of attachment 8835898 [details] [diff] [review]: ----------------------------------------------------------------- Oops! Thanks.

Pushed by btseng@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/32a03349ab9b SetManager in prior to Register to Inherit EventTarget from Manager. r=billm

Please request Aurora approval on this when you get a chance.

Comment on attachment 8835898 [details] [diff] [review] Patch: SetManager in prior to Register to Inherit EventTarget from Manager. Approval Request Comment [Feature/Bug causing the regression]: Bug 1317844 [User impact if declined]: No, this is fix is not mandatory but is nice to have because the implementation of SetEventTargetForActor() is still dummy and is pointing to the main thread in aurora. See https://hg.mozilla.org/releases/mozilla-aurora/file/tip/dom/base/TabGroup.cpp#l263 [Is this code covered by automated tests?]: No. [Has the fix been verified in Nightly?]: Yes [Needs manual test from QE? If yes, steps to reproduce]: No [List of other uplifts needed for the feature/fix]: No. [Is the change risky?]: No. [Why is the change risky/not risky?]: Because the effect of SetEventTargetForActor() is still dummy in aurora. The behavior remains the same with or without this fix. [String changes made/needed]: No.

Comment on attachment 8835898 [details] [diff] [review] Patch: SetManager in prior to Register to Inherit EventTarget from Manager. Fix a regression. Aurora53+.