709633 - Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:348

Status: RESOLVED DUPLICATE of bug 692274

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 63bff373cb94 (options -m -n -a):


test();
function test() {
  var f;
  f = function() { (let(x) {y: z}) }
    let (f = function() {
        for (var t=0;t<6;++t) ++f;
    }) { f(); } //  {  }       
  actual = f + '';
}


Filing S-s because previous infer failures turned out to be security relevant.

Comment 1

[David Mandelin [:dmandelin]]

This WFM on eb5d4c08a542 on Win 7 with a 32-bit build.

Comment 2

[Christian Holler (:decoder)]

(In reply to David Mandelin from comment #1)
> This WFM on eb5d4c08a542 on Win 7 with a 32-bit build.

Cannot confirm. Still aborts for me on eb5d4c08a542 on Linux, 64 bit build.

Comment 3

[Brian Hackett [Laid off!]]

I can repro on OS X x86 f5578fdc50ef.  I don't think this one is architecture dependent.

The '++f' in an inner function overwrites the 'var f' in the outermost function, even though that 'var f' is not marked as closed.  Tentatively marking as depending on bug 692274 which reworks handling of these let blocks.  Luke, can you test that patch on this testcase?

Comment 4

[Brian Hackett [Laid off!]]

Luke, can you look at the above comment?  (I wish bugzilla didn't throw away CC: and dependency changes when posting so easily)

Comment 5

[Luke Wagner [:luke]]

Yep, bug 692274 fixes the assert.  I'll add the testcase in comment 0 to that patch and dup this bug.