Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Assertion context_p->token.type != LEXER_RIGHT_PAREN in parser_parse_while_statement_start #3102

Closed
renatahodovan opened this issue Sep 13, 2019 · 0 comments
Labels
bug Undesired behaviour pre-scanner Related to the JavaScript pre-scanner

Comments

@renatahodovan
Copy link
Contributor

JerryScript revision

376cfea

Build platform

Linux-4.15.0-62-generic-x86_64-with-Ubuntu-18.04-bionic

Build steps
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g \
--strip=off --system-allocator=on --logging=on \
--linker-flag=-fuse-ld=gold --error-messages=on --profile=es2015-subset
Test case
while ( $(($) => {}) ) {
    while ($);
}
Output
ICE: Assertion 'context_p->token.type != LEXER_RIGHT_PAREN' failed at jerryscript/jerry-core/parser/js/js-parser-statm.c(parser_parse_while_statement_start):792.
Error: ERR_FAILED_INTERNAL_ASSERTION
Backtrace
bt
#0  0xf7fd5079 in __kernel_vsyscall ()
#1  0xf77fc832 in raise () from /lib/i386-linux-gnu/libc.so.6
#2  0xf77fdcc1 in abort () from /lib/i386-linux-gnu/libc.so.6
#3  0x565797ef in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-port/default/default-fatal.c:71
#4  0x5661336b in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x566133ac in jerry_assert_fail (assertion=0x566a3e00 "context_p->token.type != LEXER_RIGHT_PAREN", file=0x566a37a0 "jerryscript/jerry-core/parser/js/js-parser-statm.c", function=0x56693e00 <__func__.5353.lto_priv.24> "parser_parse_while_statement_start", line=792) at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x565ae8ab in parser_parse_while_statement_start.lto_priv.189 (context_p=0xffffc4b0) at jerryscript/jerry-core/parser/js/js-parser-statm.c:792
#7  0x5656fcb8 in parser_parse_statements (context_p=0xffffc4b0) at jerryscript/jerry-core/parser/js/js-parser-statm.c:2407
#8  0x565d1817 in parser_parse_source (arg_list_p=0x0, arg_list_size=0, source_p=0x566eda80 <buffer.lto_priv> "var sum = 0 ; \nvar i = 0 , j = 0 ; \ntop : while ( print ( ( static , package ) => { id_0 = 5 ; \nreturn static + package \n} ( 4 , 5 ) == 9 ) ) { j = 0 ; \nwhile ( j ++ < 20 ) { if ( j > 9 && i % 2 ) \n\ns"..., source_size=258, parse_opts=0, error_location_p=0xffffc6c0) at jerryscript/jerry-core/parser/js/js-parser.c:2530
#9  0x565d457d in parser_parse_script (arg_list_p=0x0, arg_list_size=0, source_p=0x566eda80 <buffer.lto_priv> "var sum = 0 ; \nvar i = 0 , j = 0 ; \ntop : while ( print ( ( static , package ) => { id_0 = 5 ; \nreturn static + package \n} ( 4 , 5 ) == 9 ) ) { j = 0 ; \nwhile ( j ++ < 20 ) { if ( j > 9 && i % 2 ) \n\ns"..., source_size=258, parse_opts=0, bytecode_data_p=0xffffc780) at jerryscript/jerry-core/parser/js/js-parser.c:2993
#10 0x56646c57 in jerry_parse (resource_name_p=0xffffcd9e "/home/reni/.fuzzinator_4700//jerryscript/picireny/226352238123353446202575254567104709806.js", resource_name_length=92, source_p=0x566eda80 <buffer.lto_priv> "var sum = 0 ; \nvar i = 0 , j = 0 ; \ntop : while ( print ( ( static , package ) => { id_0 = 5 ; \nreturn static + package \n} ( 4 , 5 ) == 9 ) ) { j = 0 ; \nwhile ( j ++ < 20 ) { if ( j > 9 && i % 2 ) \n\ns"..., source_size=258, parse_opts=0) at jerryscript/jerry-core/api/jerry.c:420
#11 0x56643bac in main (argc=3, argv=0xffffcb14) at jerryscript/jerry-main/main-unix.c:734

Found by Fuzzinator with grammarinator.

@rerobika rerobika added bug Undesired behaviour parser Related to the JavaScript parser labels Sep 13, 2019
zherczeg added a commit to zherczeg/jerryscript that referenced this issue Sep 16, 2019
After changing the lexing position, the current
position of the scanner info must be moved as well.

Fixes jerryscript-project#3101
Fixes jerryscript-project#3102

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg [email protected]
@rerobika rerobika added pre-scanner Related to the JavaScript pre-scanner and removed parser Related to the JavaScript parser labels Sep 17, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Undesired behaviour pre-scanner Related to the JavaScript pre-scanner
Projects
None yet
Development

No branches or pull requests

2 participants