See also bug 616027; not sure if this is a dupe or not. The testcase, originally from bug 894137, asserts since that bug is fixed (and also before the checkin of bug 548206). ###!!! ASSERTION: mForm should be null at this point!: '!mForm', file content/html/content/src/nsGenericHTMLElement.cpp, line 3170 It's not a recent regression: the assertion goes back at least to 2010-09-07, the earliest debug builds I could find on ftp.mozilla.org/pub/firefox/nightly/

This is a dup. Trying to find the bug...

Oh, silly me. I just read the summary of the bugmail I got :)

Is this assertion a security problem or is it hidden just because the original test case is bad?

> Is this assertion a security problem Probably not, tagging it sec-other for now... > is it hidden just because the original test case is bad? Yes, bug 894137 affects FF23 and is wontfixed there.

I filed it as security because of the test case from a sec-critical bug and because of what Mats said there in bug 894137 comment 10: "a different test could trigger the crash (use-after-free via mForm)."

Leaving this esr17? for now, but if it gets fixed on trunk & branches we'd need to have more clarification about 'sec-other' since currently that would not fit the criteria for landing to ESR.

FWIW bug 1162765 should eliminate the security risk here.