Bug 838567 - URL.createObjectURL(new Object()); in Workers crashes debug builds reliably. r=bent

dom/workers/URL.cpp

@@ -204,7 +204,9 @@ URL::CreateObjectURL(const WorkerGlobalObject& aGlobal, JSObject* aBlob,
   nsCOMPtr<nsIDOMBlob> blob = file::GetDOMBlobFromJSObject(aBlob);
   if (!blob) {
     SetDOMStringToNull(aResult);
-    aRv.Throw(NS_ERROR_TYPE_ERR);
+
+    NS_NAMED_LITERAL_STRING(blobStr, "Blob");
+    aRv.ThrowTypeError(MSG_DOES_NOT_IMPLEMENT_INTERFACE, &blobStr);
     return;
   }
 

dom/workers/test/url_worker.js

@@ -59,5 +59,14 @@ onmessage = function() {
   postMessage({type: 'status', status: status, msg: 'Blob URL2:' + url});
   postMessage({type: 'url', url: url});
 
+  status = false;
+  try {
+    URL.createObjectURL(new Object());
+  } catch(e) {
+    status = true;
+  }
+
+  postMessage({type: 'status', status: status, msg: 'Exception wanted' });
+
   postMessage({type: 'finish' });
 }