This is a duplicate of 1842617. My patch for that bug also fixes this test. Quickly checking in rr, it looks like we incorrectly skip the shape guard and then try to store a value in the static emptyObjectSlots object, which is mapped read-only.
Bug 1842847 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
This is a duplicate of bug 1842617. My patch for that bug also fixes this test. Quickly checking in rr, it looks like we incorrectly skip the shape guard and then try to store a value in the static emptyObjectSlots object, which is mapped read-only.