1. Run a debug build of Firefox with XPCOM_MEM_LEAK_LOG=2 2. Load the testcase. Result: ###!!! ASSERTION: bad size recorded: 'aInstanceSize == 0 || entry->GetClassSize() == aInstanceSize', file xpcom/base/nsTraceRefcntImpl.cpp, line 473 NS_LogAddRef_P [xpcom/base/nsTraceRefcntImpl.cpp:998] mozilla::dom::network::Connection::AddRef [dom/network/src/Connection.cpp:79] mozilla::dom::network::Connection::QueryInterface [dom/network/src/Connection.cpp:77] XPCWrappedNative::InitTearOff [js/xpconnect/src/XPCWrappedNative.cpp:1882] XPCWrappedNative::FindTearOff [js/xpconnect/src/XPCWrappedNative.cpp:1835] XPCWrappedNative::GetNewOrUsed [js/xpconnect/src/XPCWrappedNative.cpp:571] XPCConvert::NativeInterface2JSObject [js/xpconnect/src/XPCConvert.cpp:1056] XPCConvert::NativeData2JS [js/xpconnect/src/XPCConvert.cpp:394] CallMethodHelper::GatherAndConvertResults [js/xpconnect/src/xpcprivate.h:3228] XPCWrappedNative::CallMethod [js/xpconnect/src/XPCWrappedNative.cpp:2243] XPC_WN_GetterSetter [js/xpconnect/src/xpcprivate.h:2650] js::CallJSNative [js/src/jscntxtinlines.h:311] (A similar assertion used to happen with another API in bug 711602.)

WFM on trunk