-
Notifications
You must be signed in to change notification settings - Fork 683
Open
Labels
bugUndesired behaviourUndesired behaviourfuzzingRelated to fuzz testing of the engineRelated to fuzz testing of the engineparserRelated to the JavaScript parserRelated to the JavaScript parser
Description
jerryScript version 3.0.0:
commit 05dbbd1
Build platform:
Ubuntu 20.04
Build cmd:
python tools/build.py --debug --profile=es.next --lto=off --compile-flag=-D_POSIX_C_SOURCE=200809 --compile-flag=-Wno-strict-prototypes --stack-limit=15
Test case
class Foo {
valueOf(m, n) {
var a;
try { a = this.valueOf(); } catch (e) {}
var b = `
class Bar extends m {
constructor(a21, a22) {
}
static {
for (let i25 = 0; i25 < 5;) {
}
}
/*
constructor(a31) {
/0()*/;
isNaN(a);
}
*/
}
`;
eval(b, eval, this, a);
}
}
var c = new Foo();
c.valueOf();
Error message:
SEGV on ASAN version
AddressSanitizer:DEADLYSIGNAL
=================================================================
==505902==ERROR: AddressSanitizer: SEGV on unknown address 0x000000002cee (pc 0x55ca4212e04b bp 0x7ffc2cef5740 sp 0x7ffc2cef56a0 T0)
==505902==The signal is caused by a READ memory access.
Aborted with assertion error in debug version:
ICE: Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at jerry-core/parser/js/js-parser.c(parser_parse_function_arguments):1587.
Error: JERRY_FATAL_FAILED_ASSERTION
Aborted (core dumped)
Metadata
Metadata
Assignees
Labels
bugUndesired behaviourUndesired behaviourfuzzingRelated to fuzz testing of the engineRelated to fuzz testing of the engineparserRelated to the JavaScript parserRelated to the JavaScript parser