Closed Bug 777182 Opened 12 years ago Closed 12 years ago

IonMonkey: OOM Testing: Assertion failure: masm.framePushed() == frameSize(), at ion/CodeGenerator.cpp:290

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: crash, testcase, Whiteboard: [ion:p1:fx18])

Crash Data

The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build):

js  -e 'const libdir = "js/src/jit-test/lib/";' -A 15231 -f js/src/jit-test/tests/v8-v5/check-richards.js
This is actually bug 762037, but maybe the test here is more reliable to reproduce on the given revision for debugging.
Summary: IonMonkey: OOM Testing: Crash [@ js::ion::CodeGenerator::visitOsiPoint] → IonMonkey: OOM Testing: Assertion failure: masm.framePushed() == frameSize(), at ion/CodeGenerator.cpp:290
This one is actually dangerous, emitCallInvokeFunction has a callVM() that returns false, but does not propagate this to visitCallGeneric.
Whiteboard: [ion:p1:fx18]
This bug should be fixed with changeset https://hg.mozilla.org/projects/ionmonkey/rev/15dc7dc4243a64 (Bug 774253 attachment 646300 [details] [diff] [review])
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.