Created attachment 540330 [details] testcase (crashes Firefox when loaded) Assertion failure: proto, at js/src/jsobj.cpp:4900 (in LookupPropertyWithFlagsInline) I only see this on the TM branch. I'm guessing it's a regression from bug 656519.
The fix for bug 665355 seems to fix this too, please confirm.
Yes, the patch makes the assertion failure go away. With the patch, length is 1.