strictasm_diff_ossfuzz: terminating with uncaught exception in `YulStack::reparse()`
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 29
Description
## Description
Hi! We found a crashing test case when testing with the strictasm_diff_ossfuzz fuzzing driver
## Environment
- latest solidity version with the strictasm_diff_ossfuzz fuzzing driver
## Steps to Reproduce
POC:
```
object "outer" {
code {}
object "inner" {
code {}
data "\r" ""
}
}
```
## Error output:
```
libc++abi: terminating with uncaught exception of type boost::wrapexcept: object "outer" {
code { { } }
object "inner" {
code { { } }
" hex"" data "
}
}
Invalid IR generated:
Error: Expected 'StringLiteral' but got 'ILLEGAL'
--> source:5:14:
|
" hex"" data "
| ^
==2259631== ERROR: libFuzzer: deadly signal
#0 0x4d6971 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3
#1 0x536d5a in fuzzer::PrintStackTrace() /tmp/libfuzzer/./FuzzerUtil.cpp:205:5
#2 0x516f48 in fuzzer::Fuzzer::CrashCallback() /tmp/libfuzzer/./FuzzerLoop.cpp:236:3
#3 0x516f03 in fuzzer::Fuzzer::StaticCrashSignalCallback() /tmp/libfuzzer/./FuzzerLoop.cpp:208:6
#4 0x7f824b15f51f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: cd410b710f0f094c6832edd95931006d883af48e)
#5 0x7f824b1b39fb in __pthread_kill_implementation nptl/pthread_kill.c:43:17
#6 0x7f824b1b39fb in __pthread_kill_internal nptl/pthread_kill.c:78:10
#7 0x7f824b1b39fb in pthread_kill nptl/pthread_kill.c:89:10
#8 0x7f824b15f475 in gsignal signal/../sysdeps/posix/raise.c:26:13
#9 0x7f824b1457f2 in abort stdlib/abort.c:79:7
#10 0x1175125 in abort_message (/strictasm_diff_ossfuzz+0x1175125)
#11 0x117e22e in demangling_terminate_handler() cxa_default_handlers.cpp
#12 0x1174ba2 in std::__terminate(void (*)()) (/strictasm_diff_ossfuzz+0x1174ba2)
#13 0x1176965 in __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) cxa_exception.cpp
#14 0x11768ff in __cxa_throw (/strictasm_diff_ossfuzz+0x11768ff)
#15 0x53c153 in void boost::throw_exception(solidity::yul::YulAssertion const&) /usr/include/boost/throw_exception.hpp:165:5
#16 0x5dffc7 in solidity::yul::YulStack::reparse() /src/solidity/libyul/YulStack.cpp:220:2
#17 0x5ddaa5 in solidity::yul::YulStack::optimize() /src/solidity/libyul/YulStack.cpp:145:3
#18 0x53979f in LLVMFuzzerTestOneInput /src/solidity/test/tools/ossfuzz/strictasm_diff_ossfuzz.cpp:99:8
```
Contributor guide
Research direction
Reproduce the crash with the provided POC using the strictasm_diff_ossfuzz driver. Start in test/tools/ossfuzz/strictasm_diff_ossfuzz.cpp at LLVMFuzzerTestOneInput, then inspect libyul/YulStack.cpp around optimize() and reparse(); done means this input no longer terminates with an uncaught YulAssertion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, solidity
- Domain
- compilers, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100