Steps to reproduce:

Open developer tools on the Pottery Barn order submission page

Error in Web Developer Tools:

Error: Protocol error (SecurityError): Permission denied to access property "document" on cross-origin object from: server0.conn0.watcher3 (resource://devtools/server/actors/webconsole/listeners/document-events.js:68:11)

Client Packet:

{
  "type": "watchResources",
  "resourceTypes": [
    "document-event"
  ],
  "to": "server0.conn0.watcher3"
}

Server Packet:

{
  "from": "server0.conn0.watcher3",
  "error": "SecurityError",
  "message": "Permission denied to access property \"document\" on cross-origin object",
  "fileName": "resource://devtools/server/actors/webconsole/listeners/document-events.js",
  "lineNumber": 68,
  "columnNumber": 11
}

Server Stack:

listen@resource://devtools/server/actors/webconsole/listeners/document-events.js:68:11
watch@resource://devtools/server/actors/resources/document-event.js:103:19
watchResources@resource://devtools/server/actors/resources/index.js:367:15
addOrSetSessionDataEntry@resource://devtools/server/actors/targets/session-data-processors/resources.js:19:21
addOrSetSessionDataEntry@resource://devtools/server/actors/targets/base-target-actor.js:86:23
#addOrSetSessionDataEntry@resource://devtools/server/connectors/js-process-actor/DevToolsProcessChild.sys.mjs:398:21
receiveMessage@resource://devtools/server/connectors/js-process-actor/DevToolsProcessChild.sys.mjs:323:46

Stacktrace:

onPacket/<@resource://devtools/shared/protocol/Front.js:404:31
DevTools RDP*request@resource://devtools/shared/protocol/Front.js:320:14
generateRequestMethods/</frontProto[name]@resource://devtools/shared/protocol/Front/FrontClassWithSpec.js:57:19
_startListening@resource://devtools/shared/commands/resource/resource-command.js:1082:31

That's the line that throws: https://searchfox.org/firefox-main/rev/04cf27582307a9c351e991c740828d54cf786b76/devtools/server/actors/webconsole/listeners/document-events.js#68

if (this.targetActor.window.document.readyState != "complete") {

Matt, could you give us a link to the exact URL you saw this on please?

If I recall correctly, it was https://www.potterybarn.com/checkout/app/payment.html

Note that I had been doing things to try to address an issue with the page for a bit at this point (disabling Enhanced Tracking Protection & uBlock Origin, disabling cache, restarting from about:profiles, etc). It's definitely possible there was a race condition with one of those restarts, as going back to the page and just opening the devtools doesn't seem to recreate the issue.

Note that we also get a cross-origin issue in Bug 2003810 , and the STR sounds more reliable, we'll investigate