s = newGlobal(''); function g(code) { evalcx(code, s) } g("function f(){}"); g("a = x = f >>>= i"); asserts js debug shell on ionmonkey (where bug 804676 fixes landed for testing) changeset ae6a2cf914f7 with --no-baseline -a --ion-eager at Assertion failure: (*pvalue)->type() != propertyType, at ion/IonBuilder.cpp

This isn't a correctness assertion, but indicates in this case that a VM call is being made to capture type barriers when writing to a property that aren't necessary. When the input type to TypeSetIncludes is more precise than the input type set, the function inappropriately returns false.