Last Comment Bug 723099 - Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:352
: Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer....
Status: VERIFIED FIXED
[sg:critical] js-triage-needed
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: mozilla12
Assigned To: Brian Hackett (:bhackett)
:
Mentors:
Depends on:
Blocks: langfuzz 704387
  Show dependency treegraph
 
Reported: 2012-02-01 06:48 PST by Christian Holler (:decoder)
Modified: 2013-03-11 08:44 PDT (History)
5 users (show)
choller: in‑testsuite-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
+
fixed
+
fixed
unaffected
unaffected


Attachments
patch (681 bytes, patch)
2012-02-01 16:45 PST, Brian Hackett (:bhackett)
dvander: review+
akeybl: approval‑mozilla‑aurora+
Details | Diff | Review

Description Christian Holler (:decoder) 2012-02-01 06:48:05 PST
The following test crashes on mozilla-central revision a71b7cea4577 (options -m -a -n):


function test() {
  try {
    for ( var i = 0 in test() ) return x;
  } catch (e) {
    if (i !== ("str"))
      return "wat";
  }
}
test();


S-s because infer failures can indicate a security problem.
Comment 1 Daniel Veditz [:dveditz] 2012-02-01 15:36:10 PST
Is this a regression?
Comment 2 Brian Hackett (:bhackett) 2012-02-01 16:45:21 PST
Created attachment 593654 [details] [diff] [review]
patch

Incomplete fix for bug 719758, there are other opcodes which have no fallthrough but do not have a direct jump target.
Comment 3 Brian Hackett (:bhackett) 2012-02-01 16:47:16 PST
Comment on attachment 593654 [details] [diff] [review]
patch

[Approval Request Comment]
Regression caused by (bug #): 704387
User impact if declined: potential vulnerability
Risk to taking this patch (and alternatives if risky): low, fixes logic bug in rare code pattern
Comment 4 Alex Keybl [:akeybl] 2012-02-02 07:22:33 PST
Comment on attachment 593654 [details] [diff] [review]
patch

[Triage Comment]
Approved for Aurora 12.
Comment 5 Daniel Veditz [:dveditz] 2012-02-02 13:21:54 PST
based on the date of the regressing bug this should not affect anything earlier than Fx12
Comment 6 Brian Hackett (:bhackett) 2012-02-02 16:10:11 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/1e80318e866d
Comment 7 Ed Morley [:emorley] 2012-02-03 11:05:38 PST
https://hg.mozilla.org/mozilla-central/rev/1e80318e866d
Comment 8 Brian Hackett (:bhackett) 2012-02-06 11:23:20 PST
https://hg.mozilla.org/releases/mozilla-aurora/rev/de903fa58268
Comment 9 Christian Holler (:decoder) 2013-03-11 08:44:18 PDT
Slow/infinite test, not taking for the test suite.

Note You need to log in before you can comment on or make changes to this bug.