Thanks for the report. We have to check if there's a way to trigger this without unboxed objects. Maybe __proto__ mutation. Regardless, ObjectGroupDispatch is complicated enough that we should probably have it crash in release builds too when it sees an unexpected group.
Bug 1536768 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Thanks for the report. We have to check if there's a way to trigger this without unboxed objects. Maybe `__proto__` mutation. Regardless, ObjectGroupDispatch is complicated enough that we should probably have it crash in release builds too when it sees an unexpected group.