Created attachment 625474 [details]
partially reduced testcase
The attached testcase crashes js opt shell on IonMonkey changeset 890dd17b4187 with --ion-eager at a weird address.
The testcase is fragile, so attaching partially reduced.
Created attachment 625475 [details]
--ion-eager is needed, and this crash does not seem to reproduce in debug builds.
Gary, could you retest this after the fix for bug 756659 lands? I think it's the same bug.
(In reply to David Anderson [:dvander] from comment #2)
> Gary, could you retest this after the fix for bug 756659 lands? I think it's
> the same bug.
Likely the same bug, seemingly no longer reproduces. -> FIXED
Large fragile testcase -> in-testsuite-