Steps to reproduce: 1. Open the testcase. 2. Close the window. Result: JavaScript error: , line 0: uncaught exception: [Exception... "Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIDOMWindowInternal.alert]" nsresult: "0x80040111 (NS_ERROR_NOT_AVAILABLE)" location: "JS frame :: file:///Users/jruderman/fuzzing/lithium/a.xhtml :: :: line 14" data: no] ###!!! ASSERTION: Uh, IsInModalState() called w/o a reachable top window?: 'Error', file /Users/jruderman/central/dom/base/nsGlobalWindow.cpp, line 5763

Bug 404828 mentions one or two other ways to trigger this assertion.

I'm constantly able to hit the assertion when running toolkit/mozapps/extensions/test/browser/test_about.js alone. This test opens a modal dialog from the addons manager right frame. When exiting modal state nsAutoWindowStateHelper goes out of scope nsAutoWindowStateHelper::~nsAutoWindowStateHelper(void) calls nsGlobalWindow::LeaveModalState(nsIDOMWindow *) A nsPendingTimeoutRunner runnable is created and dispatched to main-thread now I see a nsDocShell::Destroy() that calls win->SetDocShell(nsnull), this is its stack: xul.dll!nsDocShell::Destroy() xul.dll!nsFrameLoader::Finalize() xul.dll!nsDocument::MaybeInitializeFinalizeFrameLoaders() xul.dll!nsDocument::EndUpdate() xul.dll!nsXULDocument::EndUpdate() xul.dll!mozAutoDocUpdate::~mozAutoDocUpdate() xul.dll!nsINode::doRemoveChildAt() xul.dll!nsGenericElement::RemoveChildAt() xul.dll!nsXULElement::RemoveChildAt() xul.dll!nsINode::RemoveChild() xul.dll!nsIDOMNode_RemoveChild() mozjs.dll!js::CallJSNative() At this point I see the same stack as Jesse (reversed to easy reading): nsPendingTimeoutRunner:Run RunPendingTimeoutsRecursive (in RunPendingTimeoutsRecursive) inner->RunTimeout(nsnull); IsInModalState() GetTop() (in GetTop) mDocShell IS NULL (this is the same window where SetDocShell(nsnull) was called in nsDocShell::Destroy()) ###!!! ASSERTION: Uh, IsInModalState() called w/o a reachable top window?

What could be happening in browser_about.js is: 1. the test closes the modal dialog 2. this causes a domwindowclosed to be notified 3. the test on domwindowclosed enqueues a function that closes the addons manager 4. the modal dialog is destroyed and this brings to ~nsAutoWindowStateHelper 5. LeaveModalState enqueues the nsPendingTimeoutRunner runnable 6. at this point the addons manager gets closed by the function enqueued at 3. 7. mDocShells for about:addons are destroyed 8. nsPendingTimeoutRunner enqueued at 5. runs and brings to IsInModalState() 9. the mDocShell has already been destroyed and GetTop returns nsnull