Last Comment Bug 656096 - TI+JM: Kraken crypto regression
: TI+JM: Kraken crypto regression
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-05-10 12:19 PDT by Jan de Mooij [:jandem] (PTO until July 31)
Modified: 2011-05-10 13:39 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Testcase (1.06 KB, application/x-javascript)
2011-05-10 12:19 PDT, Jan de Mooij [:jandem] (PTO until July 31)
no flags Details
Reduced testcase (764 bytes, application/javascript)
2011-05-10 13:13 PDT, Christian Holler (:decoder)
no flags Details

Description Jan de Mooij [:jandem] (PTO until July 31) 2011-05-10 12:19:56 PDT
Created attachment 531406 [details]
Testcase

Attachment is reduced from Kraken crypto-aes and crypto-ccm. It should print:
OK
test.js:19: TypeError: d is undefined

With -n -m -a it prints nothing.
Comment 1 Christian Holler (:decoder) 2011-05-10 13:13:59 PDT
Created attachment 531436 [details]
Reduced testcase
Comment 2 Brian Hackett (:bhackett) 2011-05-10 13:39:36 PDT
While analyzing a loop body's modset we could incorrectly mark the compilation as having failed without throwing an exception, which would bubble up to TryCompile and cause the interpreter to just exit, also without reporting an exception.  This adds an assertion to the compiler that if it produces an error there is a pending exception, and also fixes the loop body analysis to be infallible (it can allocate, but only into vectors with a CompilerAllocPolicy).

http://hg.mozilla.org/projects/jaegermonkey/rev/71e561e48de4

Note You need to log in before you can comment on or make changes to this bug.