Code at http://hg.mozilla.org/mozilla-central/annotate/16fc85c30a51/toolkit/components/satchel/nsFormAutoComplete.js#l316: comments.fill(1, ""); comments is an Array, and according to MDN Array.fill takes arguments value[, start[, end]]. So this call has the arguments backwards, it should be comments.fill("", 1) rather than comments.fill(1, ""). And actually looking at the context you can probably remove this call entirely because comments is initalized to empty, and then it's 0th entry is populated, so the length is 1 and fill("", 1) will be a no-op.
Looks like you added this code in http://hg.mozilla.org/mozilla-central/rev/7837f943758c, thoughts?
I wonder what happened there! I kind of assume what I wanted was more: comments = new Array(values.length); comments = "separator"; comments.fill("", 1); but given that this works with a single-element array, removing it seems fine to me.
This was fixed with my patch in bug 1242208 (not yet in central, but stuck in inbound).