If you have a JSObjectRef that has a JSConvertToTypeCallback in its class, JSCallbackObject<Base>::toString will call JSValue::getString with a JSLock::DropAllLocks in scope, causing an assertion failure. I've got a fix for this, but need to add a testcase to testapi.c.
Created attachment 20023 [details] path without changelog or test Not for review yet
Created attachment 20073 [details] Patch + ChangeLog + test
Comment on attachment 20073 [details] Patch + ChangeLog + test r=me
Committed in r31350.