[].reverse().__proto__ = null; Asserts if you paste it in a file or run like this: ./js -m -e "[].reverse().__proto__ = null;" Assertion failure: !pendingRecompiles, at ../jsinfer.cpp:1397 The bugs I filed are by far the most common assertions. There are some other (IC-related) asserts; will file these when I have more time to reduce.

Hmmm, I think I came across this one and fixed it when merging from TM yesterday evening. http://hg.mozilla.org/projects/jaegermonkey/diff/645549ce095c/js/src/jsinfer.cpp