Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Assertion JERRY_CONTEXT (jmem_heap_allocated_size) == 0 in jmem_heap_finalize #3121

Closed
renatahodovan opened this issue Sep 13, 2019 · 0 comments · Fixed by #3122
Closed

Assertion JERRY_CONTEXT (jmem_heap_allocated_size) == 0 in jmem_heap_finalize #3121

renatahodovan opened this issue Sep 13, 2019 · 0 comments · Fixed by #3122
Labels
bug Undesired behaviour ES2015 Related to ES2015 features

Comments

@renatahodovan
Copy link
Contributor

JerryScript revision

951d7e6

Build platform

Linux-4.15.0-62-generic-x86_64-with-Ubuntu-18.04-bionic

Build steps
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g \
--strip=off --system-allocator=on --logging=on \
--linker-flag=-fuse-ld=gold --error-messages=on --profile=es2015-subset
Test case
var Base = function ( ) { }.bind( );
Object.defineProperty ( Base , 'prototype' , { get : function ( ) {$} } ); 
class C extends Base { }

Note: although the assert message is the same as in #3106, but the test cases seem quite different.

Output
Script Error: TypeError: Class extends value does not have valid prototype property.
ICE: Assertion 'JERRY_CONTEXT (jmem_heap_allocated_size) == 0' failed at jerryscript/jerry-core/jmem/jmem-heap.c(jmem_heap_finalize):106.
Error: ERR_FAILED_INTERNAL_ASSERTION
Backtrace
bt
#0  0xf7fd5079 in __kernel_vsyscall ()
#1  0xf77fc832 in raise () from /lib/i386-linux-gnu/libc.so.6
#2  0xf77fdcc1 in abort () from /lib/i386-linux-gnu/libc.so.6
#3  0x565797ef in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-port/default/default-fatal.c:71
#4  0x5661336b in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x566133ac in jerry_assert_fail (assertion=0x566b1120 "JERRY_CONTEXT (jmem_heap_allocated_size) == 0", file=0x566b10c0 "jerryscript/jerry-core/jmem/jmem-heap.c", function=0x56684c40 <__func__.4681.lto_priv.114> "jmem_heap_finalize", line=106) at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x566125a9 in jmem_heap_finalize () at jerryscript/jerry-core/jmem/jmem-heap.c:106
#7  0x566123cf in jmem_finalize () at jerryscript/jerry-core/jmem/jmem-allocator.c:170
#8  0x56646629 in jerry_cleanup () at jerryscript/jerry-core/api/jerry.c:231
#9  0x5664441b in main (argc=3, argv=0xffffcb14) at jerryscript/jerry-main/main-unix.c:941

Found by Fuzzinator with grammarinator.

DanielBallaSZTE pushed a commit to DanielBallaSZTE/jerryscript that referenced this issue Sep 13, 2019
ecma_op_object_get_by_magic_id can throw an exception

Fixes jerryscript-project#3121

JerryScript-DCO-1.0-Signed-off-by: Daniel Balla [email protected]
@rerobika rerobika added bug Undesired behaviour ES2015 Related to ES2015 features labels Sep 13, 2019
zherczeg pushed a commit that referenced this issue Sep 16, 2019
ecma_op_object_get_by_magic_id can throw an exception

Fixes #3121

JerryScript-DCO-1.0-Signed-off-by: Daniel Balla [email protected]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Undesired behaviour ES2015 Related to ES2015 features
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants