Closed
Bug 655854
Opened 13 years ago
Closed 13 years ago
TI+JM: Kraken crypto-pbkdf2 regression // Assertion failure: v.isObject(), at jsnum.cpp:1309
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Unassigned)
References
Details
Attachments
(1 file)
|
2.36 KB,
application/x-javascript
|
Details |
$ ./js -m -n -a test.js Assertion failure: v.isObject(), at jsnum.cpp:1309 Revision 32e8c937a409, 32-bit OS X.
|
||
Comment 1•13 years ago
|
||
There was a broken test when we were checking whether a slot is loop invariant, such that all arguments ended up getting marked as loop invariant, leading to incorrectly hoisted bounds checks and buffer overflows (oops!). http://hg.mozilla.org/projects/jaegermonkey/rev/d1724a9944bd
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•