Assertion ecma_is_value_true (put_comp) in ecma-container-object.c

[mka-sec]

Revision

1088273

Build

./tools/build.py --clean --debug --compile-flag=-fsanitize=address
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer
--compile-flag=-fno-common --compile-flag=-g
--strip=off --system-allocator=on --logging=on
--error-messages=on --profile=es2015-subset

OS

Linux 4.15.0-58-generic #64-Ubuntu x86_64 GNU/Linux

Test case

var map = new Map();
map.set(Object.freeze({}), 1);

Backtrace

Run with jerry --abort-on-fail poc.js

ICE: Assertion 'ecma_is_value_true (put_comp)' failed at /jerryscript/jerry-core/ecma/operations/ecma-container-object.c(ecma_op_container_to_key):265.
Error: ERR_FAILED_INTERNAL_ASSERTION

Program received signal SIGABRT, Aborted.
0xf7fd5059 in __kernel_vsyscall ()
(gdb) bt
#0  0xf7fd5059 in __kernel_vsyscall ()
#1  0xf7841452 in raise () from /lib32/libc.so.6
#2  0xf7842871 in abort () from /lib32/libc.so.6
#3  0x5657ad77 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at /jerryscript/jerry-port/default/default-fatal.c:71
#4  0x56617864 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at /jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x566178a5 in jerry_assert_fail (assertion=0x56697700 "ecma_is_value_true (put_comp)", file=0x56698020 "/jerryscript/jerry-core/ecma/operations/ecma-container-object.c", 
    function=0x5668bec0 <__func__.4056.lto_priv.251> "ecma_op_container_to_key", line=265) at /jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x5658b183 in ecma_op_container_to_key (key_arg=4124051251) at /jerryscript/jerry-core/ecma/operations/ecma-container-object.c:265
#7  0x5658b745 in ecma_op_container_set (this_arg=4126148787, key_arg=4124051251, value_arg=16, lit_id=LIT_MAGIC_STRING_MAP_UL)
    at /jerryscript/jerry-core/ecma/operations/ecma-container-object.c:403
#8  0x565c23fc in ecma_builtin_map_prototype_object_set (this_arg=4126148787, key_arg=4124051251, value_arg=16)
    at /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-map-prototype.c:132
#9  0x565c22ab in ecma_builtin_map_prototype_dispatch_routine (builtin_routine_id=76, this_arg_value=4126148787, arguments_list=0xffffcc90, arguments_number=2)
    at /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-map-prototype.inc.h:46
#10 0x566213a7 in ecma_builtin_dispatch_routine (builtin_object_id=ECMA_BUILTIN_ID_MAP_PROTOTYPE, builtin_routine_id=76, this_arg_value=4126148787, arguments_list_p=0xffffcc90, 
    arguments_list_len=2) at /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1025
#11 0x56621608 in ecma_builtin_dispatch_call (obj_p=0xf5f00880, this_arg_value=4126148787, arguments_list_p=0xffffcf2c, arguments_list_len=2)
    at /jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1050
#12 0x5663396c in ecma_op_function_call (func_obj_p=0xf5f00880, this_arg_value=4126148787, arguments_list_p=0xffffcf2c, arguments_list_len=2)
    at /jerryscript/jerry-core/ecma/operations/ecma-function-object.c:729
#13 0x565e86b5 in opfunc_call (frame_ctx_p=0xffffcfa0) at /jerryscript/jerry-core/vm/vm.c:581
#14 0x565f98e8 in vm_execute (frame_ctx_p=0xffffcfa0, arg_p=0x0, arg_list_len=0) at /jerryscript/jerry-core/vm/vm.c:3622
#15 0x565fa1ec in vm_run (bytecode_header_p=0xf63015e0, this_binding_value=4126149459, lex_env_p=0xf5d007b0, parse_opts=0, arg_list_p=0x0, arg_list_len=0)
    at /jerryscript/jerry-core/vm/vm.c:3742
#16 0x565e794c in vm_run_global (bytecode_p=0xf63015e0) at /jerryscript/jerry-core/vm/vm.c:282
#17 0x5664163c in jerry_run (func_val=4126148979) at /jerryscript/jerry-core/api/jerry.c:570
#18 0x5663dfa0 in main (argc=3, argv=0xffffd3d4) at /jerryscript/jerry-main/main-unix.c:743