diff --git a/testing/xpcshell/xpcshell.ini b/testing/xpcshell/xpcshell.ini
index 544acd3c691a..ca462e5b8d59 100644
--- a/testing/xpcshell/xpcshell.ini
+++ b/testing/xpcshell/xpcshell.ini
@@ -78,6 +78,9 @@ skip-if = !debug
 [include:toolkit/crashreporter/test/unit/xpcshell.ini]
 skip-if = os == "linux" || !crashreporter
 
+[include:toolkit/crashreporter/test/unit_ipc/xpcshell.ini]
+skip-if.os == "linux" || !crashreporter
+
 #XXX: we don't actually set os = maemo
 [include:toolkit/crashreporter/client/maemo-unit/xpcshell.ini]
 run-if = os == "maemo"
diff --git a/toolkit/crashreporter/test/Makefile.in b/toolkit/crashreporter/test/Makefile.in
index cb58bb645d78..12553cd3b328 100644
--- a/toolkit/crashreporter/test/Makefile.in
+++ b/toolkit/crashreporter/test/Makefile.in
@@ -44,7 +44,7 @@ relativesrcdir  = toolkit/crashreporter/test
 include $(DEPTH)/config/autoconf.mk
 
 MODULE = crashreporter_test
-XPCSHELL_TESTS = unit
+XPCSHELL_TESTS = unit unit_ipc
 
 LIBRARY_NAME = testcrasher
 NO_DIST_INSTALL = 1
@@ -95,4 +95,5 @@ endif
 
 libs:: $(SHARED_LIBRARY) $(EXTRA_JS_MODULES)
 	$(INSTALL) $^ $(DEPTH)/_tests/xpcshell/$(relativesrcdir)/unit/
+	$(INSTALL) $^ $(DEPTH)/_tests/xpcshell/$(relativesrcdir)/unit_ipc/
 
diff --git a/toolkit/crashreporter/test/unit/crasher_subprocess_head.js b/toolkit/crashreporter/test/unit/crasher_subprocess_head.js
index 5df06164ad08..161c6031f5bd 100644
--- a/toolkit/crashreporter/test/unit/crasher_subprocess_head.js
+++ b/toolkit/crashreporter/test/unit/crasher_subprocess_head.js
@@ -2,11 +2,19 @@
 let cwd = Components.classes["@mozilla.org/file/directory_service;1"]
       .getService(Components.interfaces.nsIProperties)
       .get("CurWorkD", Components.interfaces.nsILocalFile);
+
 let crashReporter =
   Components.classes["@mozilla.org/toolkit/crash-reporter;1"]
     .getService(Components.interfaces.nsICrashReporter);
-crashReporter.enabled = true;
-crashReporter.minidumpPath = cwd;
+
+// the crash reporter is already enabled in content processes,
+// and setting the minidump path is not allowed
+let processType = Components.classes["@mozilla.org/xre/runtime;1"].
+      getService(Components.interfaces.nsIXULRuntime).processType;
+if (processType == Components.interfaces.nsIXULRuntime.PROCESS_TYPE_DEFAULT) {
+  crashReporter.enabled = true;
+  crashReporter.minidumpPath = cwd;
+}
 
 let ios = Components.classes["@mozilla.org/network/io-service;1"]
             .getService(Components.interfaces.nsIIOService);
diff --git a/toolkit/crashreporter/test/unit/head_crashreporter.js b/toolkit/crashreporter/test/unit/head_crashreporter.js
index f2aa0de52cc8..2c3dce533f22 100644
--- a/toolkit/crashreporter/test/unit/head_crashreporter.js
+++ b/toolkit/crashreporter/test/unit/head_crashreporter.js
@@ -65,6 +65,11 @@ function do_crash(setup, callback, canReturnZero)
     do_check_neq(process.exitValue, 0);
   }
 
+  handleMinidump(callback);
+}
+
+function handleMinidump(callback)
+{
   // find minidump
   let minidump = null;
   let en = do_get_cwd().directoryEntries;
@@ -101,6 +106,44 @@ function do_crash(setup, callback, canReturnZero)
     extrafile.remove(false);
 }
 
+function do_content_crash(setup, callback)
+{
+  do_load_child_test_harness();
+  do_test_pending();
+
+  // Setting the minidump path won't work in the child, so we need to do
+  // that here.
+  let crashReporter =
+      Components.classes["@mozilla.org/toolkit/crash-reporter;1"]
+      .getService(Components.interfaces.nsICrashReporter);
+  crashReporter.minidumpPath = do_get_cwd();
+
+  let headfile = do_get_file("../unit/crasher_subprocess_head.js");
+  let tailfile = do_get_file("../unit/crasher_subprocess_tail.js");
+  if (setup) {
+    if (typeof(setup) == "function")
+      // funky, but convenient
+      setup = "("+setup.toSource()+")();";
+  }
+
+  let handleCrash = function() {
+    try {            
+      handleMinidump(callback);
+    } catch (x) {
+      do_report_unexpected_exception(x);
+    }
+    do_test_finished();
+  };
+  
+  sendCommand("load(\"" + headfile.path.replace(/\\/g, "/") + "\");", function()
+    sendCommand(setup, function()
+      sendCommand("load(\"" + tailfile.path.replace(/\\/g, "/") + "\");",
+        function() do_execute_soon(handleCrash)
+      )
+    )
+  );
+}
+
 // Utility functions for parsing .extra files
 function parseKeyValuePairs(text) {
   var lines = text.split('\n');
diff --git a/toolkit/crashreporter/test/unit_ipc/test_content_annotation.js b/toolkit/crashreporter/test/unit_ipc/test_content_annotation.js
new file mode 100644
index 000000000000..419d80bfddca
--- /dev/null
+++ b/toolkit/crashreporter/test/unit_ipc/test_content_annotation.js
@@ -0,0 +1,22 @@
+load("../unit/head_crashreporter.js");
+
+function run_test()
+{
+  if (!("@mozilla.org/toolkit/crash-reporter;1" in Components.classes)) {
+    dump("INFO | test_content_annotation.js | Can't test crashreporter in a non-libxul build.\n");
+    return;
+  }
+
+  // Try crashing with a pure virtual call
+  do_content_crash(function() {
+                     crashType = CrashTestUtils.CRASH_RUNTIMEABORT;
+                     crashReporter.annotateCrashReport("TestKey", "TestValue");
+                     crashReporter.appendAppNotesToCrashReport("!!!foo!!!");
+		   },
+                   function(mdump, extra) {
+                     do_check_eq(extra.TestKey, "TestValue");
+                     do_check_true('StartupTime' in extra);
+                     do_check_true('ProcessType' in extra);
+                     do_check_neq(extra.Notes.indexOf("!!!foo!!!"), -1);
+                   });
+}
\ No newline at end of file
diff --git a/toolkit/crashreporter/test/unit_ipc/xpcshell.ini b/toolkit/crashreporter/test/unit_ipc/xpcshell.ini
new file mode 100644
index 000000000000..392a0d8a9a40
--- /dev/null
+++ b/toolkit/crashreporter/test/unit_ipc/xpcshell.ini
@@ -0,0 +1,5 @@
+[DEFAULT]
+head = head_crashreporter.js
+tail = 
+
+[test_content_annotation.js]