Skip to content

Segmentation Fault in release. Assertion 'context_p->source_p < context_p->source_end_p' failed in debug version #5105

Open
@anbu1024

Description

@anbu1024

jerryScript version 3.0.0:
commit 05dbbd1

Build platform:
Ubuntu 20.04

Build cmd:

python tools/build.py --debug --profile=es.next --lto=off --compile-flag=-D_POSIX_C_SOURCE=200809 --compile-flag=-Wno-strict-prototypes --stack-limit=15

Test case

var a = new Uint16Array(Uint16Array, Uint16Array);
var b = `
    var o = {
        m(apple) {
            class Foo extends b {
                
                static {}
                
                512;
                
                static #m() {}
            }
            return apple;
        },
    };
`;

for (var [...i] of b) {
    i.splice(a, i);
    
    b += i;
    
    function bar() {
        return Uint16Array;
    }
    
    try { bar.constructor(b); } catch (e) {}
}

Error message:

SEGV on ASAN version

AddressSanitizer:DEADLYSIGNAL
=================================================================
==510031==ERROR: AddressSanitizer: SEGV on unknown address 0x000000005198 (pc 0x5618574bc04b bp 0x7ffd51997c50 sp 0x7ffd51997bb0 T0)
==510031==The signal is caused by a READ memory access.

Aborted with assertion error in debug version:

ICE: Assertion 'context_p->source_p < context_p->source_end_p' failed at /media/Store/JS-engines/jerryscript/jerryscript-pure/jerry-core/parser/js/js-lexer.c(lexer_consume_next_character):1821.
Error: JERRY_FATAL_FAILED_ASSERTION
Aborted (core dumped)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugUndesired behaviourfuzzingRelated to fuzz testing of the enginelexerRelated to the tokenizer

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions