The following testcase asserts on ionmonkey revision 7ab88528503e (run with --ion -n -m --ion-eager):
it.customNative = assertEq;
This one reproduces with --no-ion --no-jm.
This bug exists on mozilla-central (x86, debug). Impact is limited, since it appears to require the "it" object for failure, which only exists in shell builds.
CC'ing GC team members.
Created attachment 633750 [details] [diff] [review]
If this is just a bug in GCZEAL it can probably be unhidden.
Automatically extracted testcase for this bug was committed: