The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build):
js -e 'const libdir = "js/src/jit-test/lib/";' -A 15231 -f js/src/jit-test/tests/v8-v5/check-richards.js
This is actually bug 762037, but maybe the test here is more reliable to reproduce on the given revision for debugging.
This one is actually dangerous, emitCallInvokeFunction has a callVM() that returns false, but does not propagate this to visitCallGeneric.
*** Bug 762037 has been marked as a duplicate of this bug. ***
This bug should be fixed with changeset https://hg.mozilla.org/projects/ionmonkey/rev/15dc7dc4243a64 (Bug 774253 attachment 646300 [details] [diff] [review])