search

jerryscript-project / jerryscript

Ultra-lightweight JavaScript engine for the Internet of Things.
https://jerryscript.net
Apache License 2.0
6.89k stars 669 forks source link

Assertion context_p->token.type == LEXER_LITERAL && (context_p->token.lit_location.type == LEXER_IDENT_LITERAL || context_p->token.lit_location.type == LEXER_STRING_LITERAL) in lexer_compare_literal_to_string #4997

Open renatahodovan opened 2 years ago

renatahodovan commented 2 years ago
JerryScript revision

0d496966

Build platform

Linux-5.4.0-104-generic-x86_64-with-glibc2.29

Build steps
./tools/build.py --clean --debug --profile=es.next  --error-messages=ON --logging=ON
Test case
"use strict";
function testDCE(){ if  (class { 0 = super 0 =  } ;}
Output
ICE: Assertion 'context_p->token.type == LEXER_LITERAL && (context_p->token.lit_location.type == LEXER_IDENT_LITERAL || context_p->token.lit_location.type == LEXER_STRING_LITERAL)' failed at jerryscript/jerry-core/parser/js/js-lexer.c(lexer_compare_literal_to_string):3544.
Error: JERRY_FATAL_FAILED_ASSERTION
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3265841==ERROR: AddressSanitizer: ABRT on unknown address 0x03e90031d531 (pc 0x7f27e8efd03b bp 0x7ffdbdd53e30 sp 0x7ffdbdd53bc0 T0)
    #0 0x7f27e8efd03b in raise /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
    #1 0x7f27e8edc858 in abort /build/glibc-sMfBJT/glibc-2.31/stdlib/abort.c:79:7
    #2 0x89ef3f in jerry_port_fatal jerryscript/jerry-port/common/jerry-port-process.c:29:5
    #3 0x66b742 in jerry_fatal jerryscript/jerry-core/jrt/jrt-fatals.c:63:3
    #4 0x66b4da in jerry_assert_fail jerryscript/jerry-core/jrt/jrt-fatals.c:83:3
    #5 0x826bee in lexer_compare_literal_to_string jerryscript/jerry-core/parser/js/js-lexer.c:3542:3
    #6 0x6e636f in scanner_primary_to_post_primary_expression jerryscript/jerry-core/parser/js/js-scanner.c:75:51
    #7 0x6d18d3 in scanner_scan_primary_expression jerryscript/jerry-core/parser/js/js-scanner.c:254:14
    #8 0x6c4428 in scanner_scan_all jerryscript/jerry-core/parser/js/js-scanner.c:2461:15
    #9 0x698fe5 in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:2167:3
    #10 0x69629a in parser_parse_script jerryscript/jerry-core/parser/js/js-parser.c:3326:38
    #11 0x4ced00 in jerry_parse_common jerryscript/jerry-core/api/jerryscript.c:412:21
    #12 0x4ce473 in jerry_parse jerryscript/jerry-core/api/jerryscript.c:480:10
    #13 0x89cc1f in jerryx_source_parse_script jerryscript/jerry-ext/util/sources.c:52:26
    #14 0x89cd6e in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:63:26
    #15 0x4c4d84 in main jerryscript/jerry-main/main-desktop.c:156:20
    #16 0x7f27e8ede0b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    #17 0x41c53d in _start (jerryscript/build/bin/jerry+0x41c53d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1 in raise
==3265841==ABORTING
Backtrace
bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7c33859 in __GI_abort () at abort.c:79
#2  0x000000000089ef40 in jerry_port_fatal (code=JERRY_FATAL_FAILED_ASSERTION) at jerryscript/jerry-port/common/jerry-port-process.c:29
#3  0x000000000066b743 in jerry_fatal (code=JERRY_FATAL_FAILED_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:63
#4  0x000000000066b4db in jerry_assert_fail (assertion=0x926900 <str> "context_p->token.type == LEXER_LITERAL && (context_p->token.lit_location.type == LEXER_IDENT_LITERAL || context_p->token.lit_location.type == LEXER_STRING_LITERAL)", file=0x9256a0 <str> "jerryscript/jerry-core/parser/js/js-lexer.c", function=0x9269e0 <__func__.lexer_compare_literal_to_string> "lexer_compare_literal_to_string", line=3544) at jerryscript/jerry-core/jrt/jrt-fatals.c:83
#5  0x0000000000826bef in lexer_compare_literal_to_string (context_p=0x7fffffffcd20, string_p=0x8fd480 <str> "static", string_length=6) at jerryscript/jerry-core/parser/js/js-lexer.c:3542
#6  0x00000000006e6370 in scanner_primary_to_post_primary_expression (context_p=0x7fffffffcd20, scanner_context_p=0x7fffffffbf80) at jerryscript/jerry-core/parser/js/js-scanner.c:75
#7  0x00000000006d18d4 in scanner_scan_primary_expression (context_p=0x7fffffffcd20, scanner_context_p=0x7fffffffbf80, type=LEXER_KEYW_SUPER, stack_top=SCAN_STACK_CLASS_FIELD_INITIALIZER) at jerryscript/jerry-core/parser/js/js-scanner.c:254
#8  0x00000000006c4429 in scanner_scan_all (context_p=0x7fffffffcd20) at jerryscript/jerry-core/parser/js/js-scanner.c:2461
#9  0x0000000000698fe6 in parser_parse_source (source_p=0x7fffffffd3a0, parse_opts=0, options_p=0x7fffffffd4d0) at jerryscript/jerry-core/parser/js/js-parser.c:2167
#10 0x000000000069629b in parser_parse_script (source_p=0x7fffffffd3a0, parse_opts=0, options_p=0x7fffffffd4d0) at jerryscript/jerry-core/parser/js/js-parser.c:3326
#11 0x00000000004ced01 in jerry_parse_common (source_p=0x7fffffffd3a0, options_p=0x7fffffffd4d0, parse_opts=0) at jerryscript/jerry-core/api/jerryscript.c:412
#12 0x00000000004ce474 in jerry_parse (source_p=0x626000000100 "\"use strict\"    ;     let   logOfFour   = Math   . log    ( 4     )     ;     let   validInputTestCases   = [ [ \"undefined\"    , \"NaN\"     ]    , [ \"null\"    , \"-Infinity\"     ]    , [ \"0\"    , \"-Infi"..., source_size=10247, options_p=0x7fffffffd4d0) at jerryscript/jerry-core/api/jerryscript.c:480
#13 0x000000000089cc20 in jerryx_source_parse_script (path_p=0x7fffffffde36 "/run/user/1001/fuzzinator/3261026/3265826-FileWriterDecorator-45b0efaa73a346e780b061aaaa5aea5d/0.js") at jerryscript/jerry-ext/util/sources.c:52
#14 0x000000000089cd6f in jerryx_source_exec_script (path_p=0x7fffffffde36 "/run/user/1001/fuzzinator/3261026/3265826-FileWriterDecorator-45b0efaa73a346e780b061aaaa5aea5d/0.js") at jerryscript/jerry-ext/util/sources.c:63
#15 0x00000000004c4d85 in main (argc=2, argv=0x7fffffffdb08) at jerryscript/jerry-main/main-desktop.c:156

Found by Fuzzinator with grammarinator.