Created attachment 650704 [details]
Failure in MemoryMetrics.cpp on x86_64 Debug IonMonkey browser. Might involve DOM natives.
Appears to be trivially reproducible by visiting dromaeo.com. It sometimes triggers before you get a chance to hit "Run". Also occasionally reproducible by conducting a Google search.
Built with HG commit 8c33b71cce49 (Thu Aug 09 19:43:47 2012 +0200).
Created attachment 650739 [details] [diff] [review]
Fixes the issue without creating an additional tracking kind in cStats. Traking IonCode as part of the Script seems reasonable.
As far as I can tell, this fixes the assertion. I managed to run Dromaeo about halfway (before successfully stopping it) several times, and Google searches didn't assert.