Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed in ecma-helpers-value(ecma_check_value_type_is_spec_defined) #4872

Closed
hope-fly opened this issue Dec 9, 2021 · 0 comments · Fixed by #4878
Assignees
Labels
bug Undesired behaviour

Comments

@hope-fly
Copy link

hope-fly commented Dec 9, 2021

JerryScript revision

Commit: 51da1551

Version: v3.0.0

Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)

Build steps
./tools/build.py --clean --debug --profile=es2015-subset --compile-flag=-fsanitize=address --compile-flag=-m32 --lto=off --logging=on --line-info=on --error-message=on --system-allocator=on --stack-limit=20
Test case
function JSEtest(f, iters = 1000) {
  for (let i = 0; i < iters; i++) {
    f();
  }
}

function throwTDZ(f) {
  let threw = false;
  try {
    f();
  } catch (e) {
    ;
  }
}

JSEtest(function () {
  class M {
    get foo() {
      return this._x;
    }
    set foo(x) {
      this._x = x;
    }
  }

  function fooProp() {
    return 'foo';
  }

  class T1 extends M {
    constructor() {
      super.foo = 20;
    }
  }

  class T2 extends M {
    constructor() {
      super[fooProp()] = 20;
    }
  }

  class T3 extends M {
    constructor() {
      super[fooProp()];
    }
  }

  class T4 extends M {
    constructor() {
      super.foo;
    }
  }

  class T5 extends M {
    constructor() {
      (() => super.foo = 20)();
    }
  }

  class T6 extends M {
    constructor() {
      (() => super[fooProp()] = 20)();
    }
  }

  class T7 extends M {
    constructor() {
      (() => super[fooProp()])();
    }
  }

  class T8 extends M {
    constructor() {
      (() => super.foo)();
    }
  }

  throwTDZ(function () {
    new T1();
  });
  throwTDZ(function () {
    new T2();
  });
  throwTDZ(function () {
    new T3();
  });
  throwTDZ(function () {
    new T4();
  });
  throwTDZ(function () {
    new T5();
  });
  throwTDZ(function () {
    new T6();
  });
  throwTDZ(function () {
    new T7();
  });
  throwTDZ(function () {
    new T8();
  });
});

Execution steps & Output
$ ./jerryscript/build/bin/jerry poc.js

ICE: Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed at /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_check_value_type_is_spec_defined):441.
Error: ERR_FAILED_INTERNAL_ASSERTION

Credits: Found by OWL337 team.

@rerobika rerobika self-assigned this Dec 9, 2021
rerobika pushed a commit to rerobika/jerryscript that referenced this issue Dec 9, 2021
…esent

This patch fixes jerryscript-project#4872 and fixes jerryscript-project#4876.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik robert.fancsik@h-lab.eu
@rerobika rerobika added the bug Undesired behaviour label Dec 9, 2021
ossy-szeged pushed a commit that referenced this issue Dec 15, 2021
…esent (#4878)

This patch fixes #4872 and fixes #4876.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik robert.fancsik@h-lab.eu
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Undesired behaviour
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants