Created attachment 594647 [details]
The attached testcase asserts js debug shell on IonMonkey changeset 43b55878da46 with -m, -a, --ion and -n at Assertion failure: !unknownProperties(),
This was found using a combination of jsfunfuzz and jandem's method fuzzer.
Tested when the testcase is passed in as a CLI argument.
Created attachment 594739 [details]
-a is not needed to reproduce this assert.
Still reproduces on changeset a1fc5b03be76.
Created attachment 594851 [details] [diff] [review]
Comment on attachment 594851 [details] [diff] [review]
Including that big test might be overkill.
fair enough! http://hg.mozilla.org/projects/ionmonkey/rev/d2d82d1ede00