Assertion 'qmin <= qmax' failed in re_insert_into_group

[renatahodovan]

Jerry version:

Checked revision: 8b8bced6
Build command: ./tools/build.py --clean --debug

OS:

Ubuntu 17.10

Test case:

"[]{83}".match("(?=){12,8}")

Backtrace:

ICE: Assertion 'qmin <= qmax' failed at jerryscript/jerry-core/parser/regexp/re-compiler.c(re_insert_into_group):183.
Error: ERR_FAILED_INTERNAL_ASSERTION

Program received signal SIGABRT, Aborted.
0x00005555555ce0f8 in syscall_2 () at jerryscript/jerry-libc/target/posix/jerry-asm.S:59
59	  SYSCALL_2
(gdb) bt
#0  0x00005555555ce0f8 in syscall_2 () at jerryscript/jerry-libc/target/posix/jerry-asm.S:59
#1  0x0000555555563b61 in raise (sig=6) at jerryscript/jerry-libc/target/posix/jerry-libc-target.c:98
#2  0x0000555555563b33 in abort () at jerryscript/jerry-libc/target/posix/jerry-libc-target.c:81
#3  0x000055555555ce8c in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION)
    at jerryscript/jerry-port/default/default-fatal.c:71
#4  0x00005555555a97ac in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION)
    at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x00005555555a97fe in jerry_assert_fail (assertion=0x5555555d7224 "qmin <= qmax", 
    file=0x5555555d63b8 "jerryscript/jerry-core/parser/regexp/re-compiler.c", 
    function=0x5555555e4270 <__func__.4008.lto_priv.353> "re_insert_into_group", line=183)
    at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x000055555558f6ce in re_insert_into_group (re_ctx_p=0x7fffffffd3d0, group_start_offset=1, idx=0, is_capturable=false)
    at jerryscript/jerry-core/parser/regexp/re-compiler.c:183
#7  0x000055555558f837 in re_insert_into_group_with_jump (re_ctx_p=0x7fffffffd3d0, group_start_offset=1, idx=0, 
    is_capturable=false) at jerryscript/jerry-core/parser/regexp/re-compiler.c:218
#8  0x000055555558fc79 in re_parse_alternative (re_ctx_p=0x7fffffffd3d0, expect_eof=true)
    at jerryscript/jerry-core/parser/regexp/re-compiler.c:348
#9  0x00005555555901ed in re_compile_bytecode (out_bytecode_p=0x7fffffffd450, 
    pattern_str_p=0x5555557f6548 <jerry_global_heap+472>, flags=0)
    at jerryscript/jerry-core/parser/regexp/re-compiler.c:567
#10 0x000055555556877e in ecma_op_create_regexp_object (pattern_p=0x5555557f6548 <jerry_global_heap+472>, flags_str_p=0x0)
    at jerryscript/jerry-core/ecma/operations/ecma-regexp-object.c:284
#11 0x0000555555586aba in ecma_builtin_regexp_dispatch_construct (arguments_list_p=0x7fffffffd510, arguments_list_len=1)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-regexp.c:115
#12 0x0000555555587893 in ecma_builtin_string_prepare_search.lto_priv.170 (this_arg=449, this_to_string_value_ptr=0x7fffffffd560, 
    regexp_arg=473, regexp_value=0x7fffffffd55c)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-string-prototype.c:421
#13 0x0000555555587935 in ecma_builtin_string_prototype_object_match (this_arg=449, regexp_arg=473)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-string-prototype.c:452
#14 0x0000555555586ca8 in ecma_builtin_string_prototype_dispatch_routine (builtin_routine_id=67, this_arg_value=449, 
    arguments_list=0x7fffffffd8ac, arguments_number=1)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-string-prototype.inc.h:53
#15 0x00005555555b9529 in ecma_builtin_dispatch_routine (builtin_object_id=ECMA_BUILTIN_ID_STRING_PROTOTYPE, 
    builtin_routine_id=67, this_arg_value=449, arguments_list_p=0x7fffffffd8ac, arguments_list_len=1)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:890
#16 0x00005555555b967b in ecma_builtin_dispatch_call (obj_p=0x5555557f6470 <jerry_global_heap+256>, this_arg_value=449, 
    arguments_list_p=0x7fffffffd8ac, arguments_list_len=1)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:915
#17 0x000055555559ec6c in ecma_op_function_call (func_obj_p=0x5555557f6470 <jerry_global_heap+256>, this_arg_value=449, 
    arguments_list_p=0x7fffffffd8ac, arguments_list_len=1)
    at jerryscript/jerry-core/ecma/operations/ecma-function-object.c:439
#18 0x0000555555592471 in opfunc_call (frame_ctx_p=0x7fffffffd8f0) at jerryscript/jerry-core/vm/vm.c:436
#19 0x0000555555597485 in vm_execute (frame_ctx_p=0x7fffffffd8f0, arg_p=0x0, arg_list_len=0)
    at jerryscript/jerry-core/vm/vm.c:2997
#20 0x0000555555597724 in vm_run (bytecode_header_p=0x5555557f6570 <jerry_global_heap+512>, this_binding_value=27, 
    lex_env_p=0x5555557f63a0 <jerry_global_heap+48>, is_eval_code=false, arg_list_p=0x0, arg_list_len=0)
    at jerryscript/jerry-core/vm/vm.c:3081
#21 0x0000555555592098 in vm_run_global (bytecode_p=0x5555557f6570 <jerry_global_heap+512>)
    at jerryscript/jerry-core/vm/vm.c:225
#22 0x00005555555bf14c in jerry_run (func_val=203) at jerryscript/jerry-core/api/jerry.c:550
#23 0x00005555555bdbf6 in main (argc=3, argv=0x7fffffffdc08) at jerryscript/jerry-main/main-unix.c:660

^{Found by Fuzzinator with grammarinator.}