The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build): js -e 'const libdir = "js/src/jit-test/lib/";' -A 15231 -f js/src/jit-test/tests/v8-v5/check-richards.js
This is actually bug 762037, but maybe the test here is more reliable to reproduce on the given revision for debugging.
Summary: IonMonkey: OOM Testing: Crash [@ js::ion::CodeGenerator::visitOsiPoint] → IonMonkey: OOM Testing: Assertion failure: masm.framePushed() == frameSize(), at ion/CodeGenerator.cpp:290
This one is actually dangerous, emitCallInvokeFunction has a callVM() that returns false, but does not propagate this to visitCallGeneric.
Duplicate of this bug: 762037
This bug should be fixed with changeset https://hg.mozilla.org/projects/ionmonkey/rev/15dc7dc4243a64 (Bug 774253 attachment 646300 [details] [diff] [review])
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.