search

jerryscript-project / jerryscript

Ultra-lightweight JavaScript engine for the Internet of Things.
https://jerryscript.net
Apache License 2.0
6.89k stars 669 forks source link

Assertion !has_context || context_p->next_scanner_info_p->type == SCANNER_TYPE_BLOCK in parser_parse_for_statement_start #5002

Open renatahodovan opened 2 years ago

renatahodovan commented 2 years ago
JerryScript revision

0d496966

Build platform

Linux-5.4.0-104-generic-x86_64-with-glibc2.29

Build steps
./tools/build.py --clean --debug --profile=es.next  --error-messages=ON --logging=ON
Test case
class Derived { 0( ) { for ( let in \) ;} }
Output
ICE: Assertion '!has_context || context_p->next_scanner_info_p->type == SCANNER_TYPE_BLOCK' failed at jerryscript/jerry-core/parser/js/js-parser-statm.c(parser_parse_for_statement_start):1161.
Error: JERRY_FATAL_FAILED_ASSERTION
AddressSanitizer:DEADLYSIGNAL
=================================================================
==698820==ERROR: AddressSanitizer: ABRT on unknown address 0x03e9000aa9c4 (pc 0x7f33662a603b bp 0x7ffc6c7f1ff0 sp 0x7ffc6c7f1d80 T0)
    #0 0x7f33662a603b in raise /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
    #1 0x7f3366285858 in abort /build/glibc-sMfBJT/glibc-2.31/stdlib/abort.c:79:7
    #2 0x806f07 in jerry_port_fatal jerryscript/jerry-port/common/jerry-port-process.c:29:5
    #3 0x6281ca in jerry_fatal jerryscript/jerry-core/jrt/jrt-fatals.c:63:3
    #4 0x627f7a in jerry_assert_fail jerryscript/jerry-core/jrt/jrt-fatals.c:83:3
    #5 0x7e4f87 in parser_parse_for_statement_start jerryscript/jerry-core/parser/js/js-parser-statm.c:1161:7
    #6 0x7d83fa in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2851:9
    #7 0x638e7b in parser_parse_function jerryscript/jerry-core/parser/js/js-parser.c:2717:3
    #8 0x799476 in lexer_construct_function_object jerryscript/jerry-core/parser/js/js-lexer.c:2695:23
    #9 0x7a94a4 in parser_parse_class_body jerryscript/jerry-core/parser/js/js-parser-expr.c:615:32
    #10 0x7a660e in parser_parse_class jerryscript/jerry-core/parser/js/js-parser-expr.c:1110:27
    #11 0x7d7ff9 in parser_parse_statements jerryscript/jerry-core/parser/js/js-parser-statm.c:2787:9
    #12 0x650243 in parser_parse_source jerryscript/jerry-core/parser/js/js-parser.c:2280:5
    #13 0x64bcca in parser_parse_script jerryscript/jerry-core/parser/js/js-parser.c:3326:38
    #14 0x4cd866 in jerry_parse_common jerryscript/jerry-core/api/jerryscript.c:412:21
    #15 0x4cd103 in jerry_parse jerryscript/jerry-core/api/jerryscript.c:480:10
    #16 0x805137 in jerryx_source_parse_script jerryscript/jerry-ext/util/sources.c:52:26
    #17 0x80526e in jerryx_source_exec_script jerryscript/jerry-ext/util/sources.c:63:26
    #18 0x4c4cb6 in main jerryscript/jerry-main/main-desktop.c:156:20
    #19 0x7f33662870b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    #20 0x41c53d in _start (jerryscript/build/bin/jerry+0x41c53d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1 in raise
==698820==ABORTING
Backtrace
bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7c33859 in __GI_abort () at abort.c:79
#2  0x0000000000806f08 in jerry_port_fatal (code=JERRY_FATAL_FAILED_ASSERTION) at jerryscript/jerry-port/common/jerry-port-process.c:29
#3  0x00000000006281cb in jerry_fatal (code=JERRY_FATAL_FAILED_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:63
#4  0x0000000000627f7b in jerry_assert_fail (assertion=0x896fa0 <str> "!has_context || context_p->next_scanner_info_p->type == SCANNER_TYPE_BLOCK", file=0x895d60 <str> "jerryscript/jerry-core/parser/js/js-parser-statm.c", function=0x896ea0 <__func__.parser_parse_for_statement_start> "parser_parse_for_statement_start", line=1161) at jerryscript/jerry-core/jrt/jrt-fatals.c:83
#5  0x00000000007e4f88 in parser_parse_for_statement_start (context_p=0x7fffffffcd20) at jerryscript/jerry-core/parser/js/js-parser-statm.c:1161
#6  0x00000000007d83fb in parser_parse_statements (context_p=0x7fffffffcd20) at jerryscript/jerry-core/parser/js/js-parser-statm.c:2851
#7  0x0000000000638e7c in parser_parse_function (context_p=0x7fffffffcd20, status_flags=1048598) at jerryscript/jerry-core/parser/js/js-parser.c:2717
#8  0x0000000000799477 in lexer_construct_function_object (context_p=0x7fffffffcd20, extra_status_flags=1048598) at jerryscript/jerry-core/parser/js/js-lexer.c:2695
#9  0x00000000007a94a5 in parser_parse_class_body (context_p=0x7fffffffcd20, opts=PARSER_CLASS_LITERAL_HERTIAGE_PRESENT, class_name_index=2) at jerryscript/jerry-core/parser/js/js-parser-expr.c:615
#10 0x00000000007a660f in parser_parse_class (context_p=0x7fffffffcd20, is_statement=true) at jerryscript/jerry-core/parser/js/js-parser-expr.c:1110
#11 0x00000000007d7ffa in parser_parse_statements (context_p=0x7fffffffcd20) at jerryscript/jerry-core/parser/js/js-parser-statm.c:2787
#12 0x0000000000650244 in parser_parse_source (source_p=0x7fffffffd3a0, parse_opts=0, options_p=0x7fffffffd4d0) at jerryscript/jerry-core/parser/js/js-parser.c:2280
#13 0x000000000064bccb in parser_parse_script (source_p=0x7fffffffd3a0, parse_opts=0, options_p=0x7fffffffd4d0) at jerryscript/jerry-core/parser/js/js-parser.c:3326
#14 0x00000000004cd867 in jerry_parse_common (source_p=0x7fffffffd3a0, options_p=0x7fffffffd4d0, parse_opts=0) at jerryscript/jerry-core/api/jerryscript.c:412
#15 0x00000000004cd104 in jerry_parse (source_p=0x61b000000080 "var  setterCalled   = false     ;     class Base  { func    ( ) { return 5     ;      }    funcArrow    ( ) { return ( )  => 5        ;      }    [ \"com\"   + \"puted\"    ]  ( ) { return 10     ;      }"..., source_size=1588, options_p=0x7fffffffd4d0) at jerryscript/jerry-core/api/jerryscript.c:480
#16 0x0000000000805138 in jerryx_source_parse_script (path_p=0x7fffffffde38 "/run/user/1001/fuzzinator/697673/698818-FileWriterDecorator-20a573aae7f84998ade8d7b39d36ef92/0.js") at jerryscript/jerry-ext/util/sources.c:52
#17 0x000000000080526f in jerryx_source_exec_script (path_p=0x7fffffffde38 "/run/user/1001/fuzzinator/697673/698818-FileWriterDecorator-20a573aae7f84998ade8d7b39d36ef92/0.js") at jerryscript/jerry-ext/util/sources.c:63
#18 0x00000000004c4cb7 in main (argc=2, argv=0x7fffffffdb08) at jerryscript/jerry-main/main-desktop.c:156

Found by Fuzzinator with grammarinator.