Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:352

VERIFIED FIXED in Firefox 12

Status

()

defect
--
critical
VERIFIED FIXED
8 years ago
7 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks 1 bug, {assertion, regression, testcase})

Trunk
mozilla12
x86_64
Linux
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox11 unaffected, firefox12 fixed, firefox-esr10 unaffected)

Details

(Whiteboard: js-triage-needed)

Attachments

(1 attachment)

The following test asserts on mozilla-central revision e5e66f40c35b (options -n -m -a):


function test() {
  try {
    for (var i = 0 in this) throw p;
  } catch (e) {
    if (i !== 94)
      return "expected count2 === 94, got " + count2;
  }
}
test();


S-s due to infer failure.
Posted patch patchSplinter Review
Regression from bug 704387, SSA was not accounting for values at exception targets which could only be realized from an explicit 'throw' within the exception block.
Assignee: general → bhackett1024
Attachment #590267 - Flags: review?(dvander)
Attachment #590267 - Flags: review?(dvander) → review+
https://hg.mozilla.org/mozilla-central/rev/a862ba2711fd
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla12
Status: RESOLVED → VERIFIED
Blocks: 704387
Group: core-security
Keywords: regression
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug719758.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.