Assertion object_p != NULL in ecma_make_object_value

[renatahodovan]

JerryScript revision

b6c2e6e

Build platform

Linux-4.15.0-72-generic-x86_64-with-Ubuntu-18.04-bionic

Build steps

./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g \
--strip=off --system-allocator=on --logging=on \
--linker-flag=-fuse-ld=gold --error-messages=on --profile=es2015-subset

Test case

var array = [];
array.length = 4294967295;
var $ = array.slice()

Output

ICE: Assertion 'object_p != NULL' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_make_object_value):630.
Error: ERR_FAILED_INTERNAL_ASSERTION

Backtrace

bt
#0  0xf7fd5079 in __kernel_vsyscall ()
#1  0xf77fc832 in raise () from /lib/i386-linux-gnu/libc.so.6
#2  0xf77fdcc1 in abort () from /lib/i386-linux-gnu/libc.so.6
#3  0x5657cd84 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-port/default/default-fatal.c:30
#4  0x5664fd10 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x5664fd51 in jerry_assert_fail (assertion=0x566f8380 "object_p != NULL", file=0x566f7f20 "jerryscript/jerry-core/ecma/base/ecma-helpers-value.c", function=0x566b5ca0 <__func__.4359.lto_priv.87> "ecma_make_object_value", line=630) at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x56681b27 in ecma_make_object_value (object_p=0x0) at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:630
#7  0x5665e717 in ecma_op_array_species_create (original_array_p=0xf5f01300, length=4294967295) at jerryscript/jerry-core/ecma/operations/ecma-array-object.c:707
#8  0x565f511b in ecma_builtin_array_prototype_object_slice (arg1=4126148401, arg2=72, obj_p=0xf5f01300, len=4294967295) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c:833
#9  0x565faafa in ecma_builtin_array_prototype_dispatch_routine (builtin_routine_id=86, this_arg=4126151427, arguments_list_p=0xffffc440, arguments_number=1) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c:2648
#10 0x566990cb in ecma_builtin_dispatch_routine (builtin_object_id=ECMA_BUILTIN_ID_ARRAY_PROTOTYPE, builtin_routine_id=86, this_arg_value=4126151427, arguments_list_p=0xffffc440, arguments_list_len=1) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1020
#11 0x5669932c in ecma_builtin_dispatch_call (obj_p=0xf5f004c0, this_arg_value=4126151427, arguments_list_p=0xffffc6ec, arguments_list_len=1) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1045
#12 0x5666b86c in ecma_op_function_call (func_obj_p=0xf5f004c0, this_arg_value=4126151427, arguments_list_p=0xffffc6ec, arguments_list_len=1) at jerryscript/jerry-core/ecma/operations/ecma-function-object.c:762
#13 0x56633955 in opfunc_call.lto_priv.466 (frame_ctx_p=0xffffc6b0) at jerryscript/jerry-core/vm/vm.c:699
#14 0x565e784b in vm_execute (frame_ctx_p=0xffffc6b0) at jerryscript/jerry-core/vm/vm.c:4117
#15 0x565e7e76 in vm_run (bytecode_header_p=0xf4f03780, this_binding_value=4126149459, lex_env_p=0xf5d007b0, arg_list_p=0x0, arg_list_len=0) at jerryscript/jerry-core/vm/vm.c:4240
#16 0x5663227a in vm_run_global (bytecode_p=0xf4f03780) at jerryscript/jerry-core/vm/vm.c:286
#17 0x566a0c9f in jerry_run (func_val=4126148355) at jerryscript/jerry-core/api/jerry.c:595
#18 0x5669d3cc in main (argc=2, argv=0xffffcb04) at jerryscript/jerry-main/main-unix.c:740

^{Found by Fuzzinator with grammarinator.}