Created attachment 459622 [details] testcase My fuzzer found this bug accidentally. I don't know why the XHR is needed. Assertion failure: INT_FITS_IN_JSVAL(i), at jsapi.h:252
I can't reproduce this on m-c.
Jesse, I can't reproduce on m-c either. Which branch did you see this on?
This was on m-c. I can't reproduce on Mac today. I'll retest in two weeks when I have access to my Windows build environment again.
WFM on Windows (using a Tinderbox debug build).