Comment 91 for bug 908508

I'm no expert in JS, but I think the problem you're having is that one of these ifdefs is causing an object to be marked wrong for garbage collection and it's violating an invariant. The GC depends on the property that there can be no black to grey edges (i.e., reachable to unknown), or the cycle collector may mistakenly free things that are still reachable. I suspect the problem is not that you did something wrong in your patch per se, but that not all the bases are covered. But I don't use Linux, so I'm not able to help you here much more other than to consider breaking up the assert and seeing which part it is actually failing (that assert is a macro with two conditions; see also jsgc.h).

Do you mind if I get bug 731110 landed in the meantime?