Bug 890928 - Crash when creating object url in subworker. r=bent

dom/workers/URL.cpp

@@ -144,7 +144,7 @@ public:
 
       principal = doc->NodePrincipal();
     } else {
-      MOZ_ASSERT(mWorkerPrivate->IsChromeWorker());
+      MOZ_ASSERT_IF(!mWorkerPrivate->GetParent(), mWorkerPrivate->IsChromeWorker());
       principal = mWorkerPrivate->GetPrincipal();
     }
 
@@ -199,7 +199,7 @@ public:
 
       principal = doc->NodePrincipal();
     } else {
-      MOZ_ASSERT(mWorkerPrivate->IsChromeWorker());
+      MOZ_ASSERT_IF(!mWorkerPrivate->GetParent(), mWorkerPrivate->IsChromeWorker());
       principal = mWorkerPrivate->GetPrincipal();
     }
 

dom/workers/test/test_url.html

@@ -21,7 +21,7 @@
     is(event.target, worker);
 
     if (event.data.type == 'finish') {
-      SimpleTest.finish();
+      runTest();
     } else if (event.data.type == 'status') {
       ok(event.data.status, event.data.msg);
     } else if (event.data.type == 'url') {
@@ -42,8 +42,22 @@
     SimpleTest.finish();
   };
 
-  worker.postMessage(true);
+  var tests = [
+    function() { worker.postMessage(0); },
+    function() { worker.postMessage(4); }
+  ];
 
+  function runTest() {
+    if (!tests.length) {
+      SimpleTest.finish();
+      return;
+    }
+
+    var test = tests.shift();
+    test();
+  }
+
+  runTest();
   SimpleTest.waitForExplicitFinish();
 
 </script>

dom/workers/test/url_worker.js

@@ -1,4 +1,14 @@
-onmessage = function() {
+onmessage = function(event) {
+  if (event.data != 0) {
+    var worker = new Worker('url_worker.js');
+    worker.onmessage = function(event) {
+      postMessage(event.data);
+    }
+
+    worker.postMessage(event.data - 1);
+    return;
+  }
+
   status = false;
   try {
     if ((URL instanceof Object)) {