Restoring window state fires a focus event on the last focused content, per bug 274784 comment 119. This can trigger location changes or history navigation which can reenter docshell code and state restoration. I think docshell would get very confused if this happens.

This triggers the behavior, I think (load the testcase, focus the textfield, go back). I could only get it to happen with a window focus listener; a focus listener on the textbox doesn't seem to get fired (which is itself a bug if we fire blur on it as you leave the page). Nothing crashes or anything, but you get: WARNING: NS_ENSURE_TRUE(mRequest) failed, file /builds/mozilla/bfcache/mozilla/netwerk/protocol/file/src/nsFileChannel.cpp, line 172 if the testcase is local. The worst I can visibly see happening is that the page is nuked from the back cache, but there may be other side-effects.

The focused content doesn't see a blur as the page is hidden nor does it see a focus as the page is restored (the ESM sees it as already focused, I think). This is probably ok IMO. So I think the only way to trigger this is via the focus event on the window.

targetting to beta for further investigation

With all of the window state restoration happening async now, I don't think this is an issue any longer. I no longer see the aforementioned assert or any other problems with this test case (testing with the patch for bug 303267 applied so that event handlers are correctly restored.