Created attachment 594647 [details] testcase The attached testcase asserts js debug shell on IonMonkey changeset 43b55878da46 with -m, -a, --ion and -n at Assertion failure: !unknownProperties(), This was found using a combination of jsfunfuzz and jandem's method fuzzer.
Tested when the testcase is passed in as a CLI argument.
-a is not needed to reproduce this assert.
Still reproduces on changeset a1fc5b03be76.
Created attachment 594851 [details] [diff] [review] fix
Comment on attachment 594851 [details] [diff] [review] fix Including that big test might be overkill.