Created attachment 558254 [details] Test case for shell (see README file inside). The following test asserts on mozilla-central revision a351ae35f2c4 (with shell build fix from mozilla-inbound rev fff3dc9478ce) 32 bit debug build. For exact running instructions, see README inside the tarball. Note that the original assert (before minimization) was different, it was: Assertion failure: allocated(), at ../../jsgc.h:740 This test is quite fragile, let me know if you can't reproduce. I can provide shell access in that case.
Sadly, this was not the bug I was looking for. Thanks, though.