Last Comment Bug 723099 - Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:352
: Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer....
[sg:critical] js-triage-needed
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
-- critical (vote)
: mozilla12
Assigned To: Brian Hackett (:bhackett)
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz 704387
  Show dependency treegraph
Reported: 2012-02-01 06:48 PST by Christian Holler (:decoder)
Modified: 2013-03-11 08:44 PDT (History)
5 users (show)
choller: in‑testsuite-
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (681 bytes, patch)
2012-02-01 16:45 PST, Brian Hackett (:bhackett)
dvander: review+
akeybl: approval‑mozilla‑aurora+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-02-01 06:48:05 PST
The following test crashes on mozilla-central revision a71b7cea4577 (options -m -a -n):

function test() {
  try {
    for ( var i = 0 in test() ) return x;
  } catch (e) {
    if (i !== ("str"))
      return "wat";

S-s because infer failures can indicate a security problem.
Comment 1 User image Daniel Veditz [:dveditz] 2012-02-01 15:36:10 PST
Is this a regression?
Comment 2 User image Brian Hackett (:bhackett) 2012-02-01 16:45:21 PST
Created attachment 593654 [details] [diff] [review]

Incomplete fix for bug 719758, there are other opcodes which have no fallthrough but do not have a direct jump target.
Comment 3 User image Brian Hackett (:bhackett) 2012-02-01 16:47:16 PST
Comment on attachment 593654 [details] [diff] [review]

[Approval Request Comment]
Regression caused by (bug #): 704387
User impact if declined: potential vulnerability
Risk to taking this patch (and alternatives if risky): low, fixes logic bug in rare code pattern
Comment 4 User image Alex Keybl [:akeybl] 2012-02-02 07:22:33 PST
Comment on attachment 593654 [details] [diff] [review]

[Triage Comment]
Approved for Aurora 12.
Comment 5 User image Daniel Veditz [:dveditz] 2012-02-02 13:21:54 PST
based on the date of the regressing bug this should not affect anything earlier than Fx12
Comment 6 User image Brian Hackett (:bhackett) 2012-02-02 16:10:11 PST
Comment 7 User image Ed Morley [:emorley] 2012-02-03 11:05:38 PST
Comment 8 User image Brian Hackett (:bhackett) 2012-02-06 11:23:20 PST
Comment 9 User image Christian Holler (:decoder) 2013-03-11 08:44:18 PDT
Slow/infinite test, not taking for the test suite.

Note You need to log in before you can comment on or make changes to this bug.