IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: string, at jsinfer.cpp:328

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
major
VERIFIED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Assigned: dvander)

Tracking

(Blocks: 2 bugs, {assertion, sec-critical, testcase})

Other Branch
x86_64
Linux
assertion, sec-critical, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox14 unaffected, firefox15 unaffected, firefox16 unaffected, firefox-esr10 unaffected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision de23a9fc29db (run with --ion -n -m --ion-eager):


function f(arr) {
    return arr[0] + arr[1] + assertEq[2];
}
var g2 = f("var b = 2;");
Keywords: sec-critical
status-firefox14: --- → unaffected
status-firefox15: --- → unaffected
status-firefox16: --- → affected
tracking-firefox16: --- → +
(Assignee)

Updated

5 years ago
Assignee: general → dvander
Status: NEW → ASSIGNED
(Assignee)

Comment 1

5 years ago
Created attachment 637756 [details] [diff] [review]
fix
Attachment #637756 - Flags: review?(bhackett1024)
(Assignee)

Updated

5 years ago
Duplicate of this bug: 765485
Attachment #637756 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 3

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/ee11e95dc7bc
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Assignee)

Updated

5 years ago
Duplicate of this bug: 764790

Updated

5 years ago
status-firefox-esr10: --- → unaffected
(Assignee)

Updated

5 years ago
status-firefox16: affected → unaffected
tracking-firefox16: + → ---
(Reporter)

Updated

5 years ago
Status: RESOLVED → VERIFIED
(Reporter)

Comment 5

5 years ago
JSBugMon: This bug has been automatically verified fixed.
Group: core-security
You need to log in before you can comment on or make changes to this bug.