762037 - IonMonkey: Assertion failure: masm.framePushed() == 0, at ion/shared/CodeGenerator-x86-shared.cpp:111 with OOM

Status: RESOLVED DUPLICATE of bug 777182

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase asserts on ionmonkey revision ff28f1696c5a (run with --ion -n).

Comment 1

[Sean Stangl [:sstangl]]

I can't seem to run the testcase.
Following instructions in the README produces:

[sstangl@mozdesk testMasmFramePushed]$ ~/dev/ionmonkey/js/src/dbg64/js --ion -n -f shell.js -f main.js
ReferenceError: jsTestDriverEnd is not defined
ReferenceError: jsTestDriverEnd is not defined
ReferenceError: jsTestDriverEnd is not defined
ReferenceError: jsTestDriverEnd is not defined
ReferenceError: jsTestDriverEnd is not defined
ReferenceError: reference to undefined XML name *::*
ReferenceError: jsTestDriverEnd is not defined
ReferenceError: g is not defined
ReferenceError: jsTestDriverEnd is not defined
9846ae0d6e2877fcbac6d0d51ae571f8c45399c7.js:96: out of memory

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

I can't reproduce this either with the given revision and instructions.

Comment 3

[Christian Holler (:decoder)]

What configure options did you use on the specified revision? I used --enable-debug --disable-optimize --enable-valgrind --enable-more-deterministic. The test does not reproduce for me on tip anymore, but I still see the assert on tip fuzzing results.