class A { }
class B extends A { constructor(a,b,c,d){ eval("eval ('super (a, b, c, d)')"); super.__proto__} }
var a = new B();
Output
ICE: Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_check_value_type_is_spec_defined):432.
Error: JERRY_FATAL_FAILED_ASSERTION
AddressSanitizer:DEADLYSIGNAL
=================================================================
==698630==ERROR: AddressSanitizer: ABRT on unknown address 0x03e9000aa906 (pc 0x7f00a4d4203b bp 0x7ffee59ac660 sp 0x7ffee59ac3f0 T0)
#0 0x7f00a4d4203b in raise /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
#1 0x7f00a4d21858 in abort /build/glibc-sMfBJT/glibc-2.31/stdlib/abort.c:79:7
#2 0x806f07 in jerry_port_fatal jerryscript/jerry-port/common/jerry-port-process.c:29:5
#3 0x6281ca in jerry_fatal jerryscript/jerry-core/jrt/jrt-fatals.c:63:3
#4 0x627f7a in jerry_assert_fail jerryscript/jerry-core/jrt/jrt-fatals.c:83:3
#5 0x53101d in ecma_check_value_type_is_spec_defined jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:430:3
#6 0x5a92ea in ecma_op_require_object_coercible jerryscript/jerry-core/ecma/operations/ecma-conversion.c:61:3
#7 0x73fbd3 in ecma_builtin_object_object_set_proto jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object.c:253:8
#8 0x73d7de in ecma_builtin_object_prototype_dispatch_routine jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object-prototype.c:448:12
#9 0x56f39d in ecma_builtin_dispatch_routine jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1460:10
#10 0x56ead1 in ecma_builtin_dispatch_call jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1489:12
#11 0x5b9af2 in ecma_op_function_call_native_built_in jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1217:5
#12 0x5b8640 in ecma_op_function_call jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1411:16
#13 0x5dad85 in ecma_op_object_put_with_receiver jerryscript/jerry-core/ecma/operations/ecma-objects.c:1615:5
#14 0x6b1dd6 in opfunc_assign_super_reference jerryscript/jerry-core/vm/opcodes.c:2073:5
#15 0x6d4f07 in vm_loop jerryscript/jerry-core/vm/vm.c:2852:20
#16 0x6bb8f1 in vm_execute jerryscript/jerry-core/vm/vm.c:5211:37
#17 0x6b975b in vm_run jerryscript/jerry-core/vm/vm.c:5312:10
#18 0x5bf4c8 in ecma_op_function_call_constructor jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1036:15
#19 0x5b8f30 in ecma_op_function_call_simple jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1116:14
#20 0x5bac78 in ecma_op_function_construct_simple jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1492:28
#21 0x5ba7eb in ecma_op_function_construct jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1713:14
#22 0x6f20b5 in opfunc_construct jerryscript/jerry-core/vm/vm.c:840:7
#23 0x6bba38 in vm_execute jerryscript/jerry-core/vm/vm.c:5236:9
#24 0x6b975b in vm_run jerryscript/jerry-core/vm/vm.c:5312:10
#25 0x6b91b7 in vm_run_global jerryscript/jerry-core/vm/vm.c:286:25
#26 0x4ce357 in jerry_run jerryscript/jerry-core/api/jerryscript.c:548:24
#27 0x8052c9 in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:68:14
#28 0x4c4cb6 in main jerryscript/jerry-main/main-desktop.c:156:20
#29 0x7f00a4d230b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
#30 0x41c53d in _start (jerryscript/build/bin/jerry+0x41c53d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1 in raise
==698630==ABORTING
Backtrace
bt
#0 [33m__GI_raise[m ([36msig=sig@entry[m=6) at [32m../sysdeps/unix/sysv/linux/raise.c[m:50
#1 [34m0x00007ffff7c33859[m in [33m__GI_abort[m () at [32mabort.c[m:79
#2 [34m0x0000000000806f08[m in [33mjerry_port_fatal[m ([36mcode[m=JERRY_FATAL_FAILED_ASSERTION) at [32mjerryscript/jerry-port/common/jerry-port-process.c[m:29
#3 [34m0x00000000006281cb[m in [33mjerry_fatal[m ([36mcode[m=JERRY_FATAL_FAILED_ASSERTION) at [32mjerryscript/jerry-core/jrt/jrt-fatals.c[m:63
#4 [34m0x0000000000627f7b[m in [33mjerry_assert_fail[m ([36massertion[m=0x82d0a0 <str> "ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_i"..., [36mfile[m=0x82d1c0 <str> "jerryscript/jerry-core/ecma/base/ecma-helpers-value.c", [36mfunction[m=0x82d240 <__func__.ecma_check_value_type_is_spec_defined> "ecma_check_value_type_is_spec_defined", [36mline[m=432) at [32mjerryscript/jerry-core/jrt/jrt-fatals.c[m:83
#5 [34m0x000000000053101e[m in [33mecma_check_value_type_is_spec_defined[m ([36mvalue[m=104) at [32mjerryscript/jerry-core/ecma/base/ecma-helpers-value.c[m:430
#6 [34m0x00000000005a92eb[m in [33mecma_op_require_object_coercible[m ([36mvalue[m=104) at [32mjerryscript/jerry-core/ecma/operations/ecma-conversion.c[m:61
#7 [34m0x000000000073fbd4[m in [33mecma_builtin_object_object_set_proto[m ([36marg1[m=104, [36marg2[m=160) at [32mjerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object.c[m:253
#8 [34m0x000000000073d7df[m in [33mecma_builtin_object_prototype_dispatch_routine[m ([36mbuiltin_routine_id[m=8 '\b', [36mthis_arg[m=104, [36marguments_list_p[m=0x7fffffff6920, [36marguments_number[m=1) at [32mjerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object-prototype.c[m:448
#9 [34m0x000000000056f39e[m in [33mecma_builtin_dispatch_routine[m ([36mfunc_obj_p[m=0x11dfeb0 <jerry_global_heap+1968>, [36mthis_arg_value[m=104, [36marguments_list_p[m=0x7fffffff6920, [36marguments_list_len[m=1) at [32mjerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c[m:1460
#10 [34m0x000000000056ead2[m in [33mecma_builtin_dispatch_call[m ([36mobj_p[m=0x11dfeb0 <jerry_global_heap+1968>, [36mthis_arg_value[m=104, [36marguments_list_p[m=0x7fffffff6d20, [36marguments_list_len[m=1) at [32mjerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c[m:1489
#11 [34m0x00000000005b9af3[m in [33mecma_op_function_call_native_built_in[m ([36mfunc_obj_p[m=0x11dfeb0 <jerry_global_heap+1968>, [36mthis_arg_value[m=104, [36marguments_list_p[m=0x7fffffff6d20, [36marguments_list_len[m=1) at [32mjerryscript/jerry-core/ecma/operations/ecma-function-object.c[m:1217
#12 [34m0x00000000005b8641[m in [33mecma_op_function_call[m ([36mfunc_obj_p[m=0x11dfeb0 <jerry_global_heap+1968>, [36mthis_arg_value[m=104, [36marguments_list_p[m=0x7fffffff6d20, [36marguments_list_len[m=1) at [32mjerryscript/jerry-core/ecma/operations/ecma-function-object.c[m:1411
#13 [34m0x00000000005dad86[m in [33mecma_op_object_put_with_receiver[m ([36mobject_p[m=0x11dfa90 <jerry_global_heap+912>, [36mproperty_name_p[m=0x1f6d, [36mvalue[m=160, [36mreceiver[m=104, [36mis_throw[m=true) at [32mjerryscript/jerry-core/ecma/operations/ecma-objects.c[m:1615
#14 [34m0x00000000006b1dd7[m in [33mopfunc_assign_super_reference[m ([36mvm_stack_top_p[m=0x7fffffff74a0, [36mframe_ctx_p[m=0x7fffffffc840, [36mopcode_data[m=168) at [32mjerryscript/jerry-core/vm/opcodes.c[m:2073
#15 [34m0x00000000006d4f08[m in [33mvm_loop[m ([36mframe_ctx_p[m=0x7fffffffc840) at [32mjerryscript/jerry-core/vm/vm.c[m:2852
#16 [34m0x00000000006bb8f2[m in [33mvm_execute[m ([36mframe_ctx_p[m=0x7fffffffc840) at [32mjerryscript/jerry-core/vm/vm.c[m:5211
#17 [34m0x00000000006b975c[m in [33mvm_run[m ([36mshared_p[m=0x7fffffffcb80, [36mthis_binding_value[m=104, [36mlex_env_p[m=0x11dfb68 <jerry_global_heap+1128>) at [32mjerryscript/jerry-core/vm/vm.c[m:5312
#18 [34m0x00000000005bf4c9[m in [33mecma_op_function_call_constructor[m ([36mshared_args_p[m=0x7fffffffcb80, [36mscope_p[m=0x11dfb68 <jerry_global_heap+1128>, [36mthis_binding[m=104) at [32mjerryscript/jerry-core/ecma/operations/ecma-function-object.c[m:1036
#19 [34m0x00000000005b8f31[m in [33mecma_op_function_call_simple[m ([36mfunc_obj_p[m=0x11dfbb0 <jerry_global_heap+1200>, [36mthis_binding[m=72, [36marguments_list_p[m=0x7fffffffd288, [36marguments_list_len[m=6) at [32mjerryscript/jerry-core/ecma/operations/ecma-function-object.c[m:1116
#20 [34m0x00000000005bac79[m in [33mecma_op_function_construct_simple[m ([36mfunc_obj_p[m=0x11dfbb0 <jerry_global_heap+1200>, [36mnew_target_p[m=0x11dfbb0 <jerry_global_heap+1200>, [36marguments_list_p[m=0x7fffffffd288, [36marguments_list_len[m=6) at [32mjerryscript/jerry-core/ecma/operations/ecma-function-object.c[m:1492
#21 [34m0x00000000005ba7ec[m in [33mecma_op_function_construct[m ([36mfunc_obj_p[m=0x11dfbb0 <jerry_global_heap+1200>, [36mnew_target_p[m=0x11dfbb0 <jerry_global_heap+1200>, [36marguments_list_p[m=0x7fffffffd288, [36marguments_list_len[m=6) at [32mjerryscript/jerry-core/ecma/operations/ecma-function-object.c[m:1713
#22 [34m0x00000000006f20b6[m in [33mopfunc_construct[m ([36mframe_ctx_p[m=0x7fffffffd240) at [32mjerryscript/jerry-core/vm/vm.c[m:840
#23 [34m0x00000000006bba39[m in [33mvm_execute[m ([36mframe_ctx_p[m=0x7fffffffd240) at [32mjerryscript/jerry-core/vm/vm.c[m:5236
#24 [34m0x00000000006b975c[m in [33mvm_run[m ([36mshared_p[m=0x7fffffffd460, [36mthis_binding_value[m=11, [36mlex_env_p[m=0x11df9f0 <jerry_global_heap+752>) at [32mjerryscript/jerry-core/vm/vm.c[m:5312
#25 [34m0x00000000006b91b8[m in [33mvm_run_global[m ([36mbytecode_p[m=0x11dfe08 <jerry_global_heap+1800>, [36mfunction_object_p[m=0x11df9e0 <jerry_global_heap+736>) at [32mjerryscript/jerry-core/vm/vm.c[m:286
#26 [34m0x00000000004ce358[m in [33mjerry_run[m ([36mscript[m=739) at [32mjerryscript/jerry-core/api/jerryscript.c[m:548
#27 [34m0x00000000008052ca[m in [33mjerryx_source_exec_script[m ([36mpath_p[m=0x7fffffffde38 "/run/user/1001/fuzzinator/697673/698628-FileWriterDecorator-51cb32bd94fc469c9f02930f2319071c/0.js") at [32mjerryscript/jerry-ext/util/sources.c[m:68
#28 [34m0x00000000004c4cb7[m in [33mmain[m ([36margc[m=2, [36margv[m=0x7fffffffdb08) at [32mjerryscript/jerry-main/main-desktop.c[m:156
JerryScript revision
0d496966
Build platform
Linux-5.4.0-104-generic-x86_64-with-glibc2.29
Build steps
Test case
Output
Backtrace
Found by Fuzzinator with grammarinator.