This assert is firing on four tests, that can be found by running jit-tests with --ion. One of the tests is testCallApply (I can't see the others right now since TBPL is down). This is most likely a regression from the TI patch that fixed v8-raytrace, which we took in a recent merge.
This will also fix the crash on Mochitest column 1 seen only in debug builds.
Created attachment 646071 [details] [diff] [review] Patch If UseNewTypeForClone is true, we have to give the clone a singleton type and clone the script, we don't want the fast path to handle these cases.