STR: 1. Open the Web Console. 2. Enter "AudioContext()" in there and press Enter. 3. Click on the object in order to inspect it. This is what happens: Assertion failure: IS_WN_WRAPPER(obj), at /Users/ehsanakhgari/moz/mozilla-central/js/xpconnect/src/XPCJSID.cpp:530 Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000 nsJSIID::HasInstance (this=0x1107f7a60, wrapper=0x11088cc50, cx=0x1005119e0, obj=0x11293beb0, val=@0x7fff5fbe8d70, bp=0x7fff5fbe8d8f, _retval=0x7fff5fbe8d7f) at /Users/ehsanakhgari/moz/mozilla-central/js/xpconnect/src/XPCJSID.cpp:530 530 MOZ_ASSERT(IS_WN_WRAPPER(obj)); (gdb) bt 10 #0 nsJSIID::HasInstance (this=0x1107f7a60, wrapper=0x11088cc50, cx=0x1005119e0, obj=0x11293beb0, val=@0x7fff5fbe8d70, bp=0x7fff5fbe8d8f, _retval=0x7fff5fbe8d7f) at /Users/ehsanakhgari/moz/mozilla-central/js/xpconnect/src/XPCJSID.cpp:530 #1 0x000000010316bcde in non-virtual thunk to nsJSIID::HasInstance(nsIXPConnectWrappedNative*, JSContext*, JSObject*, JS::Value const&, bool*, bool*) (this=0x1107f7a68, wrapper=0x11088cc50, cx=0x1005119e0, obj=0x11293beb0, val=@0x7fff5fbe8d70, bp=0x7fff5fbe8d8f, _retval=0x7fff5fbe8d7f) at /Users/ehsanakhgari/moz/mozilla-central/js/xpconnect/src/XPCJSID.cpp:556 #2 0x00000001031c9e06 in XPC_WN_Helper_HasInstance (cx=0x1005119e0, obj={<js::HandleBase<JSObject *>> = {<No data fields>}, ptr = 0x7fff5fbeba78}, valp={<js::MutableHandleBase<JS::Value>> = {<js::MutableValueOperations<JS::MutableHandle<JS::Value> >> = {<js::ValueOperations<JS::MutableHandle<JS::Value> >> = {<No data fields>}, <No data fields>}, <No data fields>}, ptr = 0x7fff5fbe8e80}, bp=0x7fff5fbeaadc) at /Users/ehsanakhgari/moz/mozilla-central/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:976 #3 0x0000000105587b32 in js::HasInstance (cx=0x1005119e0, obj={<js::HandleBase<JSObject *>> = {<No data fields>}, ptr = 0x7fff5fbeba78}, v={<js::HandleBase<JS::Value>> = {<js::ValueOperations<JS::Handle<JS::Value> >> = {<No data fields>}, <No data fields>}, ptr = 0x10f7002a8}, bp=0x7fff5fbeaadc) at /Users/ehsanakhgari/moz/mozilla-central/js/src/jsinterp.cpp:578 #4 0x00000001055825ad in js::Interpret (cx=0x1005119e0, entryFrame=0x10f700228, interpMode=js::JSINTERP_NORMAL) at /Users/ehsanakhgari/moz/mozilla-central/js/src/jsinterp.cpp:3125 #5 0x000000010556a66b in js::RunScript (cx=0x1005119e0, fp=0x10f700228) at /Users/ehsanakhgari/moz/mozilla-central/js/src/jsinterp.cpp:341 #6 0x0000000105585246 in js::InvokeKernel (cx=0x1005119e0, args={<JS::CallReceiver> = {usedRval_ = false, argv_ = 0x10f700218}, argc_ = 2}, construct=js::NO_CONSTRUCT) at /Users/ehsanakhgari/moz/mozilla-central/js/src/jsinterp.cpp:398 #7 0x0000000105493b05 in js::Invoke (cx=0x1005119e0, args=@0x7fff5fbeef78, construct=js::NO_CONSTRUCT) at jsinterp.h:135 #8 0x0000000105585dc6 in js::Invoke (cx=0x1005119e0, thisv=@0x10f7001f0, fval=@0x7fff5fbef100, argc=2, argv=0x10f7001f8, rval=0x7fff5fbef150) at /Users/ehsanakhgari/moz/mozilla-central/js/src/jsinterp.cpp:431 #9 0x0000000105645936 in js::BaseProxyHandler::call (this=0x1076c7360, cx=0x1005119e0, proxy={<js::HandleBase<JSObject *>> = {<No data fields>}, ptr = 0x7fff5fbef410}, argc=2, vp=0x10f7001e8) at /Users/ehsanakhgari/moz/mozilla-central/js/src/jsproxy.cpp:316 (More stack frames follow...) This is where the assertion happens: <http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/src/XPCJSID.cpp#535>, and it's triggers by this instanceof check: <http://mxr.mozilla.org/mozilla-central/source/toolkit/devtools/webconsole/WebConsoleUtils.jsm#477>

Probably the same as bug 855955.

I would think this would be bug 854139. Does it still reproduce?

Oh, no sorry my tree was old. This has been fixed.