IonMonkey: OOM Testing: Assertion failure: masm.framePushed() == frameSize(), at ion/CodeGenerator.cpp:290

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {crash, testcase})

Other Branch
x86_64
Linux
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [ion:p1:fx18], crash signature)

(Reporter)

Description

5 years ago
The following command crashes on ionmonkey revision b82fb4d04f60 (dbg build):

js  -e 'const libdir = "js/src/jit-test/lib/";' -A 15231 -f js/src/jit-test/tests/v8-v5/check-richards.js
(Reporter)

Comment 1

5 years ago
This is actually bug 762037, but maybe the test here is more reliable to reproduce on the given revision for debugging.
Summary: IonMonkey: OOM Testing: Crash [@ js::ion::CodeGenerator::visitOsiPoint] → IonMonkey: OOM Testing: Assertion failure: masm.framePushed() == frameSize(), at ion/CodeGenerator.cpp:290
This one is actually dangerous, emitCallInvokeFunction has a callVM() that returns false, but does not propagate this to visitCallGeneric.
Whiteboard: [ion:p1:fx18]
Duplicate of this bug: 762037
This bug should be fixed with changeset https://hg.mozilla.org/projects/ionmonkey/rev/15dc7dc4243a64 (Bug 774253 attachment 646300 [details] [diff] [review])
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.