Created attachment 653223 [details]
asserts js debug shell on m-c changeset 35b8d6ef5d46 without any CLI arguments at Assertion failure: isObject(),
This is blowing up the fuzzers so setting [fuzzblocker].
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
user: Shu-yu Guo
date: Fri Aug 17 10:38:59 2012 -0700
summary: Bug 778559 - Implement ParallelArray API with sequential execution (r=dmandelin)
Locking s-s because the possibly-related bug 783924 is s-s. The crash in this bug seems to be a null crash though.
(setting csec-dos because of null crash)
Created attachment 653228 [details]
stack from opt crash
Created attachment 653229 [details] [diff] [review]
fix and testcase
JSBugMon: This bug has been automatically verified fixed.
Automatically extracted testcase for this bug was committed: