Created attachment 570430 [details]
Testcase for shell
The attached testcase asserts on jaegermonkey revision b01eb1ba58ce (run with -m -n), tested on 64 bit.
Created attachment 570554 [details] [diff] [review]
GC hazard when constructing functions, setSingletonType can now trigger GC and was called before a new function was fully initialized.