Created attachment 599816 [details] testcase 1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi 2. Load the testcase Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at js/src/jsgc.cpp:4364 (Continuation of bug 704258?) (I'm confused: why does gczeal(4) matter even when followed by gczeal(0)?)
Once bug 715761 is fully landed (just one more small patch to go), this will get fixed.