740595 - "Assertion failure: [infer failure] Missing type pushed 0:"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

MLList.prototype.(Function)

asserts js debug shell on m-c changeset 92fe907ddac8 with -m, -a and -n at Assertion failure: [infer failure] Missing type pushed 0: [0xf7400180],

s-s because infer failures are bad, assuming worse case [sg:critical].

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   76042:b769a2b79e6b
user:        Brian Hackett
date:        Fri Jul 15 10:14:07 2011 -0700
summary:     [INFER] Lazily create type objects for singleton JS objects, bug 670185.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Treat FILTER/ENDFILTER as unknown.  Sorry about the delay here.

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 613384 [details] [diff] [review]
patch

http://mozillamemes.tumblr.com/post/20381316930/inspired-by-a-bugfix-which-caused-a

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d32163dc9902

Comment 4

[Brian Hackett [Laid off!]]

Comment on attachment 613384 [details] [diff] [review]
patch

[Approval Request Comment]
User impact if declined: Potential, difficult to exploit vulnerability.
Risk to taking this patch (and alternatives if risky): None.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/mozilla-central/rev/d32163dc9902

Comment 6

[Daniel Veditz [:dveditz]]

Since it's a small, safe fix we should take it on branches: a single-line testcase could easily be discovered by other people's fuzzers.

Comment 7

[Alex Keybl [:akeybl]]

Comment on attachment 613384 [details] [diff] [review]
patch

(In reply to Daniel Veditz [:dveditz] from comment #6)
> Since it's a small, safe fix we should take it on branches: a single-line
> testcase could easily be discovered by other people's fuzzers.

Agreed. Approving for all branches.

Comment 8

[Al Billings [:abillings - ex-MoCo]]

Resolving fixed since it is on mozilla central.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Resolving fixed since it is on mozilla central.

http://hg.mozilla.org/mozilla-central/rev/d32163dc9902

Thanks for helping to resolve. It would be great if one could add the hgweb link of the landing on mozilla-central too. :)

Comment 10

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 11

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/7dfac7263e72
https://hg.mozilla.org/releases/mozilla-beta/rev/0f0c508e014d

Comment 12

[Al Billings [:abillings - ex-MoCo]]

(In reply to Christian Holler (:decoder) from comment #10)
> JSBugMon: This bug has been automatically verified fixed.

I love this tool.

Comment 13

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/releases/mozilla-esr10/rev/cb77dd01451f

Comment 14

[u279076]

Verified fixed for esr10 using 2012-04-16 mozilla-esr10 js-shell

Comment 15

[Mihaela Velimiroviciu (:mihaelav)]

Ubuntu 11.10 32bit

Verified that the testcase from comment #0 produces no assertion with latest mozilla-beta revision (8072115a9e89)

Marking verified for Firefox 13

Comment 16

[Mihaela Velimiroviciu (:mihaelav)]

Ubuntu 11.10 32bit

Verified that the testcase from comment #0 produces no assertion with Firefox 14 beta 6 (revision 89ec8943347a)

Marking verified for Firefox 14

Comment 17

[Christian Holler (:decoder)]

E4X has been removed, in-testsuite-.