Created attachment 650704 [details] Backtrace. Failure in MemoryMetrics.cpp on x86_64 Debug IonMonkey browser. Might involve DOM natives. Appears to be trivially reproducible by visiting dromaeo.com. It sometimes triggers before you get a chance to hit "Run". Also occasionally reproducible by conducting a Google search. Built with HG commit 8c33b71cce49 (Thu Aug 09 19:43:47 2012 +0200). Backtrace attached.
Created attachment 650739 [details] [diff] [review] patch Fixes the issue without creating an additional tracking kind in cStats. Traking IonCode as part of the Script seems reasonable. As far as I can tell, this fixes the assertion. I managed to run Dromaeo about halfway (before successfully stopping it) several times, and Google searches didn't assert.