The following test asserts on mozilla-central revision 959c1e6bdb11 (options -m -n -a): gczeal(2); string="" for (var i = 0; i < 100; i++ ) hex=newGlobal('same-compartment'); S-s for now because this is GC related.
I got this too in jsfunfuzz.
And I get this in the browser with RandomJS. (My testcase also uses gczeal.)
Created attachment 562481 [details] [diff] [review] fix This was a bogus assertion, unfortunately. The setOwnerObject call was supposed to happen right after setting u.i.script. But that inadvertently got broken in a few places. I've added a setter to make it less likely for this to happen again.
Also, not S-S. Except for the assertion, the code was fine.
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug688939.js.