723099 - Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:352

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on mozilla-central revision a71b7cea4577 (options -m -a -n):


function test() {
  try {
    for ( var i = 0 in test() ) return x;
  } catch (e) {
    if (i !== ("str"))
      return "wat";
  }
}
test();


S-s because infer failures can indicate a security problem.

Comment 1

[Daniel Veditz [:dveditz]]

Is this a regression?

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Incomplete fix for bug 719758, there are other opcodes which have no fallthrough but do not have a direct jump target.

Comment 3

[Brian Hackett [Laid off!]]

Comment on attachment 593654 [details] [diff] [review]
patch

[Approval Request Comment]
Regression caused by (bug #): 704387
User impact if declined: potential vulnerability
Risk to taking this patch (and alternatives if risky): low, fixes logic bug in rare code pattern

Comment 4

[Alex Keybl [:akeybl]]

Comment on attachment 593654 [details] [diff] [review]
patch

[Triage Comment]
Approved for Aurora 12.

Comment 5

[Daniel Veditz [:dveditz]]

based on the date of the regressing bug this should not affect anything earlier than Fx12

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1e80318e866d

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/1e80318e866d

Comment 8

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/de903fa58268

Comment 9

[Christian Holler (:decoder)]

Slow/infinite test, not taking for the test suite.