let x = [ ]; let k = 1 ; for ( ; ; ) { k = k * 2 ; x [ k ] = k }
Output
ICE: Assertion 'index <= ECMA_DIRECT_STRING_MAX_IMM' failed at jerryscript/jerry-core/ecma/operations/ecma-array-object.c(ecma_fast_array_convert_to_normal):321.
Error: JERRY_FATAL_FAILED_ASSERTION
AddressSanitizer:DEADLYSIGNAL
=================================================================
==699588==ERROR: AddressSanitizer: ABRT on unknown address 0x03e9000aacc4 (pc 0x7f59ddac303b bp 0x7ffdc60e4d60 sp 0x7ffdc60e4af0 T0)
#0 0x7f59ddac303b in raise /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
#1 0x7f59ddaa2858 in abort /build/glibc-sMfBJT/glibc-2.31/stdlib/abort.c:79:7
#2 0x806f07 in jerry_port_fatal jerryscript/jerry-port/common/jerry-port-process.c:29:5
#3 0x6281ca in jerry_fatal jerryscript/jerry-core/jrt/jrt-fatals.c:63:3
#4 0x627f7a in jerry_assert_fail jerryscript/jerry-core/jrt/jrt-fatals.c:83:3
#5 0x587ef3 in ecma_fast_array_convert_to_normal jerryscript/jerry-core/ecma/operations/ecma-array-object.c:321:5
#6 0x588b40 in ecma_fast_array_set_property jerryscript/jerry-core/ecma/operations/ecma-array-object.c:385:5
#7 0x5d8eb3 in ecma_op_object_put_with_receiver jerryscript/jerry-core/ecma/operations/ecma-objects.c:1378:18
#8 0x6f4829 in vm_op_set_value jerryscript/jerry-core/vm/vm.c:224:16
#9 0x6ed5e4 in vm_loop jerryscript/jerry-core/vm/vm.c:4741:43
#10 0x6bb8f1 in vm_execute jerryscript/jerry-core/vm/vm.c:5211:37
#11 0x6b975b in vm_run jerryscript/jerry-core/vm/vm.c:5312:10
#12 0x6b91b7 in vm_run_global jerryscript/jerry-core/vm/vm.c:286:25
#13 0x4ce357 in jerry_run jerryscript/jerry-core/api/jerryscript.c:548:24
#14 0x8052c9 in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:68:14
#15 0x4c4cb6 in main jerryscript/jerry-main/main-desktop.c:156:20
#16 0x7f59ddaa40b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
#17 0x41c53d in _start (jerryscript/build/bin/jerry+0x41c53d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1 in raise
==699588==ABORTING
Backtrace
bt
#0 [33m__GI_raise[m ([36msig=sig@entry[m=6) at [32m../sysdeps/unix/sysv/linux/raise.c[m:50
#1 [34m0x00007ffff7c33859[m in [33m__GI_abort[m () at [32mabort.c[m:79
#2 [34m0x0000000000806f08[m in [33mjerry_port_fatal[m ([36mcode[m=JERRY_FATAL_FAILED_ASSERTION) at [32mjerryscript/jerry-port/common/jerry-port-process.c[m:29
#3 [34m0x00000000006281cb[m in [33mjerry_fatal[m ([36mcode[m=JERRY_FATAL_FAILED_ASSERTION) at [32mjerryscript/jerry-core/jrt/jrt-fatals.c[m:63
#4 [34m0x0000000000627f7b[m in [33mjerry_assert_fail[m ([36massertion[m=0x83e3e0 <str> "index <= ECMA_DIRECT_STRING_MAX_IMM", [36mfile[m=0x83e020 <str> "jerryscript/jerry-core/ecma/operations/ecma-array-object.c", [36mfunction[m=0x83e380 <__func__.ecma_fast_array_convert_to_normal> "ecma_fast_array_convert_to_normal", [36mline[m=321) at [32mjerryscript/jerry-core/jrt/jrt-fatals.c[m:83
#5 [34m0x0000000000587ef4[m in [33mecma_fast_array_convert_to_normal[m ([36mobject_p[m=0x11dfa38 <jerry_global_heap+824>) at [32mjerryscript/jerry-core/ecma/operations/ecma-array-object.c[m:321
#6 [34m0x0000000000588b41[m in [33mecma_fast_array_set_property[m ([36mobject_p[m=0x11dfa38 <jerry_global_heap+824>, [36mindex[m=131072, [36mvalue[m=2097152) at [32mjerryscript/jerry-core/ecma/operations/ecma-array-object.c[m:385
#7 [34m0x00000000005d8eb4[m in [33mecma_op_object_put_with_receiver[m ([36mobject_p[m=0x11dfa38 <jerry_global_heap+824>, [36mproperty_name_p[m=0x11dfa48 <jerry_global_heap+840>, [36mvalue[m=2097152, [36mreceiver[m=827, [36mis_throw[m=false) at [32mjerryscript/jerry-core/ecma/operations/ecma-objects.c[m:1378
#8 [34m0x00000000006f482a[m in [33mvm_op_set_value[m ([36mbase[m=827, [36mproperty[m=2097152, [36mvalue[m=2097152, [36mis_strict[m=false) at [32mjerryscript/jerry-core/vm/vm.c[m:224
#9 [34m0x00000000006ed5e5[m in [33mvm_loop[m ([36mframe_ctx_p[m=0x7fffffffd240) at [32mjerryscript/jerry-core/vm/vm.c[m:4741
#10 [34m0x00000000006bb8f2[m in [33mvm_execute[m ([36mframe_ctx_p[m=0x7fffffffd240) at [32mjerryscript/jerry-core/vm/vm.c[m:5211
#11 [34m0x00000000006b975c[m in [33mvm_run[m ([36mshared_p[m=0x7fffffffd460, [36mthis_binding_value[m=11, [36mlex_env_p[m=0x11df9f0 <jerry_global_heap+752>) at [32mjerryscript/jerry-core/vm/vm.c[m:5312
#12 [34m0x00000000006b91b8[m in [33mvm_run_global[m ([36mbytecode_p[m=0x11dfc58 <jerry_global_heap+1368>, [36mfunction_object_p[m=0x11df9e0 <jerry_global_heap+736>) at [32mjerryscript/jerry-core/vm/vm.c[m:286
#13 [34m0x00000000004ce358[m in [33mjerry_run[m ([36mscript[m=739) at [32mjerryscript/jerry-core/api/jerryscript.c[m:548
#14 [34m0x00000000008052ca[m in [33mjerryx_source_exec_script[m ([36mpath_p[m=0x7fffffffde38 "/run/user/1001/fuzzinator/697673/699585-FileWriterDecorator-a1ff659e50ab42cb9b802f43f58d16fc/0.js") at [32mjerryscript/jerry-ext/util/sources.c[m:68
#15 [34m0x00000000004c4cb7[m in [33mmain[m ([36margc[m=2, [36margv[m=0x7fffffffdb08) at [32mjerryscript/jerry-main/main-desktop.c[m:156
JerryScript revision
0d496966
Build platform
Linux-5.4.0-104-generic-x86_64-with-glibc2.29
Build steps
Test case
Output
Backtrace
Found by Fuzzinator with grammarinator.