search

google / closure-compiler

A JavaScript checker and optimizer.
https://developers.google.com/closure/compiler/
Apache License 2.0
7.37k stars 1.15k forks source link

NullPointerException Evaluating initial value of AbstractVar for 'arguments' #3861

Closed jkukucka closed 2 years ago

jkukucka commented 3 years ago

This was found during fuzzing research.

Input for $SIMPLE_OPTIMIZATIONS

throw (function(e_3, d_63){ for((get);;((! ((this) ? ((z_52) ? (("듴顋ѧ斷㽗䕾࿹䁋넌갤侍呾轢ꕭ䶸핏襊筐")(("䕯탇᫚"))) : (~ (false))) : (l_14))) ? (o_26) : (false))){ switch((arguments (628))) {};break;(677) } })

Stack Trace:

java.lang.RuntimeException: INTERNAL COMPILER ERROR.
Please file a bug at http://go/jscompiler-bug with this stack trace, sponge link, and repro steps (a CL# and a build target).

null
  Node(CALL): input0:1:153
throw (function(e_3, d_63){ for((get);;((! ((this) ? ((z_52) ? (("??????????????????")(("???"))) : (~ (false))) : (l_14))) ? (o_26) : (false))){ switch((arguments (628))) {};break;(677) } })
  Parent(SWITCH): input0:1:145
throw (function(e_3, d_63){ for((get);;((! ((this) ? ((z_52) ? (("??????????????????")(("???"))) : (~ (false))) : (l_14))) ? (o_26) : (false))){ switch((arguments (628))) {};break;(677) } })

    at com.google.javascript.jscomp.JSCompiler.throwInternalError(JSCompiler.java:196)
    at com.google.javascript.jscomp.NodeTraversal.throwUnexpectedException(NodeTraversal.java:442)
    at com.google.javascript.jscomp.NodeTraversal.traverse(NodeTraversal.java:462)
    at com.google.javascript.jscomp.NodeTraversal$Builder.traverse(NodeTraversal.java:398)
    at com.google.javascript.jscomp.NodeTraversal.traverse(NodeTraversal.java:468)
    at com.google.javascript.jscomp.ConstParamCheck.process(ConstParamCheck.java:60)
    at com.google.javascript.jscomp.PhaseOptimizer$NamedPass.process(PhaseOptimizer.java:317)
    at com.google.javascript.jscomp.PhaseOptimizer.process(PhaseOptimizer.java:232)
    at com.google.javascript.jscomp.Compiler.performOptimizations(Compiler.java:2583)
    at com.google.javascript.jscomp.Compiler.lambda$stage2Passes$8(Compiler.java:960)
    at com.google.javascript.jscomp.CompilerExecutor.runInCompilerThread(CompilerExecutor.java:127)
    at com.google.javascript.jscomp.Compiler.runInCompilerThread(Compiler.java:1006)
    at com.google.javascript.jscomp.Compiler.stage2Passes(Compiler.java:957)
    at com.google.javascript.jscomp.Compiler.compileModules(Compiler.java:899)
    at com.google.javascript.jscomp.debugger.CompilationServlet.service(CompilationServlet.java:99)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
    at org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1459)
    at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:799)
    at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1626)
    at com.google.apphosting.utils.servlet.JdbcMySqlConnectionCleanupFilter.doFilter(JdbcMySqlConnectionCleanupFilter.java:62)
    at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
    at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
    at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
    at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:578)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
    at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
    at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
    at com.google.apphosting.runtime.jetty9.ParseBlobUploadHandler.handle(ParseBlobUploadHandler.java:111)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
    at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
    at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434)
    at com.google.apphosting.runtime.jetty94.AppEngineWebAppContext.doHandle(AppEngineWebAppContext.java:234)
    at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
    at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
    at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
    at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
    at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
    at com.google.apphosting.runtime.jetty94.AppVersionHandlerMap.handle(AppVersionHandlerMap.java:256)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
    at org.eclipse.jetty.server.Server.handle(Server.java:516)
    at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:388)
    at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:633)
    at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:380)
    at com.google.apphosting.runtime.jetty94.RpcConnection.handle(RpcConnection.java:243)
    at com.google.apphosting.runtime.jetty94.RpcConnector.serviceRequest(RpcConnector.java:83)
    at com.google.apphosting.runtime.jetty94.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:158)
    at com.google.apphosting.runtime.JavaRuntime$RequestRunnable.dispatchServletRequest(JavaRuntime.java:794)
    at com.google.apphosting.runtime.JavaRuntime$RequestRunnable.dispatchRequest(JavaRuntime.java:757)
    at com.google.apphosting.runtime.JavaRuntime$RequestRunnable.run(JavaRuntime.java:727)
    at com.google.apphosting.runtime.ThreadGroupPool$PoolEntry.run(ThreadGroupPool.java:261)
    at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.NullPointerException
    at com.google.javascript.jscomp.NodeUtil.getRValueOfLValue(NodeUtil.java:5099)
    at com.google.javascript.jscomp.AbstractVar.getInitialValue(AbstractVar.java:183)
    at com.google.javascript.jscomp.ConstParamCheck.visit(ConstParamCheck.java:88)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:888)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:879)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:879)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:879)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:879)
    at com.google.javascript.jscomp.NodeTraversal.traverseFunction(NodeTraversal.java:927)
    at com.google.javascript.jscomp.NodeTraversal.handleFunction(NodeTraversal.java:792)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:835)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:879)
    at com.google.javascript.jscomp.NodeTraversal.traverseChildren(NodeTraversal.java:1016)
    at com.google.javascript.jscomp.NodeTraversal.handleScript(NodeTraversal.java:780)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:832)
    at com.google.javascript.jscomp.NodeTraversal.traverseBranch(NodeTraversal.java:879)
    at com.google.javascript.jscomp.NodeTraversal.traverse(NodeTraversal.java:459)
    ... 52 more

Reproduce URL: https://closure-compiler-debugger.appspot.com/#input0%3Dthrow%2520(function(e_3%252C%2520d_63)%257B%2520for((get)%253B%253B((!%2520((this)%2520%253F%2520((z_52)%2520%253F%2520((%2522%25EB%2593%25B4%25E9%25A1%258B%25D1%25A7%25E6%2596%25B7%25E3%25BD%2597%25E4%2595%25BE%25E0%25BF%25B9%25E4%2581%258B%25EB%2584%258C%25EA%25B0%25A4%25E4%25BE%258D%25E5%2591%25BE%25E8%25BD%25A2%25EA%2595%25AD%25E4%25B6%25B8%25ED%2595%258F%25E8%25A5%258A%25E7%25AD%2590%2522)((%2522%25E4%2595%25AF%25ED%2583%2587%25E1%25AB%259A%2522)))%2520%253A%2520(~%2520(false)))%2520%253A%2520(l_14)))%2520%253F%2520(o_26)%2520%253A%2520(false)))%257B%2520switch((arguments%2520(628)))%2520%257B%257D%253Bbreak%253B(677)%2520%257D%2520%257D)%250A%26input1%26conformanceConfig%26externs%26refasterjs-template%26CHECK_TYPES%3Dtrue%26REWRITE_MODULES_BEFORE_TYPECHECKING%3Dtrue%26ALIAS_ALL_STRINGS%3Dtrue%26AMBIGUATE_PROPERTIES%3Dtrue%26COALESCE_VARIABLE_NAMES%3Dtrue%26COLLAPSE_VARIABLE_DECLARATIONS%3Dtrue%26COLLAPSE_ANONYMOUS_FUNCTIONS%3Dtrue%26COLLAPSE_PROPERTIES%3Dtrue%26COLLAPSE_OBJECT_LITERALS%3Dtrue%26COMPUTE_FUNCTION_SIDE_EFFECTS%3Dtrue%26CONVERT_TO_DOTTED_PROPERTIES%3Dtrue%26CROSS_CHUNK_CODE_MOTION%3Dtrue%26CROSS_CHUNK_METHOD_MOTION%3Dtrue%26DEAD_ASSIGNMENT_ELIMINATION%3Dtrue%26DEVIRTUALIZE_METHODS%3Dtrue%26DISAMBIGUATE_PROPERTIES%3Dtrue%26EXTRACT_PROTOTYPE_MEMBER_DECLARATIONS%3Dtrue%26FOLD_CONSTANTS%3Dtrue%26INLINE_CONSTANTS%3Dtrue%26INLINE_FUNCTIONS%3Dtrue%26INLINE_PROPERTIES%3Dtrue%26INLINE_VARIABLES%3Dtrue%26LABEL_RENAMING%3Dtrue%26OPTIMIZE_CALLS%3Dtrue%26OPTIMIZE_CONSTRUCTORS%3Dtrue%26OPTIMIZE_ARGUMENTS_ARRAY%3Dtrue%26REMOVE_ABSTRACT_METHODS%3Dtrue%26REMOVE_DEAD_CODE%3Dtrue%26REMOVE_UNUSED_CLASS_PROPERTIES%3Dtrue%26REMOVE_UNUSED_PROTOTYPE_PROPERTIES%3Dtrue%26REMOVE_UNUSED_VARIABLES%3Dtrue%26REWRITE_FUNCTION_EXPRESSIONS%3Dtrue%26SMART_NAME_REMOVAL%3Dtrue%26USE_TYPES_FOR_LOCAL_OPTIMIZATION%3Dtrue%26VARIABLE_RENAMING%3Dtrue%26PROPERTY_RENAMING%3Dtrue%26MOVE_FUNCTION_DECLARATIONS%3Dtrue%26SYNTHETIC_BLOCK_MARKER%3Dtrue%26CLOSURE_PASS%3Dtrue%26PRESERVE_TYPE_ANNOTATIONS%3Dtrue%26PRETTY_PRINT%3Dtrue

lauraharker commented 3 years ago

Simplified repro:

(function () {
  arguments (628);
})

So the issue arises when trying to call arguments as a function. I think we should at least make AbstractVar.getInitialValue not crash.

https://closure-compiler-debugger.appspot.com/#input0%3D(function%2520()%2520%257B%250A%2520%2520arguments%2520(628)%253B%250A%257D)%26input1%26conformanceConfig%26externs%26refasterjs-template%26CLOSURE_PASS%3Dtrue%26PRESERVE_TYPE_ANNOTATIONS%3Dtrue%26PRETTY_PRINT%3Dtrue