Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' in parser_parse_expression #3819

Closed
owl337 opened this issue May 31, 2020 · 0 comments · Fixed by #3828
Closed
Assignees
Labels
bug Undesired behaviour

Comments

@owl337
Copy link

owl337 commented May 31, 2020

JerryScript revision

d06c3a7

Build platform

Ubuntu 16.04.6 LTS (Linux 4.15.0-99-generic x86_64)

Build steps
python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g \
--error-messages=on --debug --compile-flag=-g --strip=off --logging=on \
--compile-flag=-fsanitize=address --stack-limit=15
Test case
typeof (global.v2) = 123;
Output
ICE: Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' failed at /home/JerryScript/jerryscript/jerry-core/parser/js/js-parser-expr.c(parser_parse_expression):3565.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted (core dumped)

Credits: This vulnerability is detected by chong from OWL337.

@owl337 owl337 changed the title ICE: Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' failed at /home/JerryScript/jerryscript/jerry-core/parser/js/js-parser-expr.c(parser_parse_expression):3565. Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' in parser_parse_expression May 31, 2020
@rerobika rerobika self-assigned this Jun 2, 2020
@rerobika rerobika added the bug Undesired behaviour label Jun 2, 2020
rerobika pushed a commit to rerobika/jerryscript that referenced this issue Jun 2, 2020
This patch fixes jerryscript-project#3815 and fixes jerryscript-project#3819.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
@rerobika rerobika linked a pull request Jun 2, 2020 that will close this issue
rerobika pushed a commit to rerobika/jerryscript that referenced this issue Jun 3, 2020
This patch fixes jerryscript-project#3815 and fixes jerryscript-project#3819.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
rerobika pushed a commit to rerobika/jerryscript that referenced this issue Jun 3, 2020
This patch fixes jerryscript-project#3815 and fixes jerryscript-project#3819.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
rerobika pushed a commit to rerobika/jerryscript that referenced this issue Jun 3, 2020
This patch fixes jerryscript-project#3815 and fixes jerryscript-project#3819.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
rerobika pushed a commit to rerobika/jerryscript that referenced this issue Jun 3, 2020
This patch fixes jerryscript-project#3815 and fixes jerryscript-project#3819.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
dbatyai pushed a commit that referenced this issue Jun 3, 2020
This patch fixes #3815 and fixes #3819.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Undesired behaviour
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants