Closed Bug 719750 Opened 9 years ago Closed 8 years ago

Assertion failure: [infer failure] Missing type pushed 0: int with destructuring assignment

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

VERIFIED WORKSFORME
Tracking Status
firefox10 - wontfix
firefox11 - wontfix
firefox12 - wontfix
firefox13 - wontfix
firefox14 + wontfix
firefox15 + fixed
firefox16 --- fixed
firefox-esr10 --- wontfix
status1.9.2 --- unaffected

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, sec-critical, testcase, Whiteboard: [sg:critical][advisory-tracking+])

The following test asserts on mozilla-central revision e5e66f40c35b (options -n -m -a):


function f( )  {
  var [ [x], e ]  = ["*", "/", "%"];
    function h() {
      for (var i = 0; i < 5; ++i) {
        x = i * 2;
      }
    }
    h();
  assertEq(x, 8);
} 
f();


This bug strongly reminds me of bug 685321 which also had a destructuring assignment. S-s due to infer failure.
Yeah, this looks almost identical to bug 685321.  The 'x' in f() is not marked as closed yet is overwritten within h().
Blocks: 685321, 708892
I would expect bug 685321 to take care of this. I just tested m-i rev 374975f24277 and it WFM.
(In reply to David Mandelin from comment #2)
> I would expect bug 685321 to take care of this. I just tested m-i rev
> 374975f24277 and it WFM.

I thought bug 685321 was already fixed? I just re-tested this on m-i tip (0a116f325333) and still get the crash.
Yeah, either this is a different underlying problem from bug 685321 (though the problem is still during parsing/emitting) or the bug 685321 fix was not complete.
Whiteboard: js-triage-needed → [sg:critical] js-triage-needed
Whiteboard: [sg:critical] js-triage-needed → [sg:critical] js-triage-needed [needs testing on Fx10 and Fx11]
No longer blocks: 708892
Depends on: 708892
Whiteboard: [sg:critical] js-triage-needed [needs testing on Fx10 and Fx11] → [sg:critical] [needs testing on Fx10 and Fx11]
Whiteboard: [sg:critical] [needs testing on Fx10 and Fx11] → [sg:critical]
Not going to push for this for 11.
This depends on bug 708892, which is too complicated to fix in time for 12.
(In reply to David Mandelin from comment #6)
> This depends on bug 708892, which is too complicated to fix in time for 12.

How will we get all the depends-on bugs backported to ESR once this does get fixed?
(In reply to Daniel Veditz [:dveditz] from comment #7)
> (In reply to David Mandelin from comment #6)
> > This depends on bug 708892, which is too complicated to fix in time for 12.
> 
> How will we get all the depends-on bugs backported to ESR once this does get
> fixed?

Hmmm, not sure. Getting it fixed at is apparently difficult enough, so I'll worry about ESR once we get there.
This WFM on trunk. I bet Luke's scope chain work fixed it. That was a huge chain of work and basically a new feature so backport is not realistic. Is there anything to do other than close WFM and mark branches wontfix?
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
Luke, could you please add this to the testsuite as well?
Flags: in-testsuite?
(In reply to Gary Kwong [:gkw, :nth10sd] from comment #10)
> Luke, could you please add this to the testsuite as well?

As far as I know, this affects ESR and I don't know if it was fixed because the original fix cannot be backported. If this is not fixed on ESR then adding the test now will make it much easier to detect this.
Test landed on mozilla-inbound:

http://hg.mozilla.org/integration/mozilla-inbound/rev/bb2a5759abb4
Flags: in-testsuite? → in-testsuite+
Whiteboard: [sg:critical] → [sg:critical][advisory-tracking+]
Group: core-security
You need to log in before you can comment on or make changes to this bug.