SEGV in Variable::getParent()
- Dominant language
- JavaScript
- Stars
- 11.3k
- Forks
- 859
- Avg merge
- 1h 30m
- Merged PRs (30d)
- 3
Description
From static_h branch:
POC:
```
var o ={
set x(v){
super[c]++;
}
}
```
ASAN:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==286619==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x561f9372d78f bp 0x7fff05d26580 sp 0x7fff05d26570 T0)
==286619==The signal is caused by a READ memory access.
==286619==Hint: address points to the zero page.
#0 0x561f9372d78f in hermes::Variable::getParent() const /home/ubuntu/hermes/include/hermes/IR/IR.h:1376
#1 0x561f93734c7a in hermes::irgen::ESTreeIRGen::createLRef(hermes::ESTree::Node*, bool) (/home/ubuntu/asan_build/bin/hermes+0x8c6c7a)
#2 0x561f93783ebe in hermes::irgen::ESTreeIRGen::genUpdateExpr(hermes::ESTree::UpdateExpressionNode*) /home/ubuntu/hermes/lib/IRGen/ESTreeIRGen-expr.cpp:2252
#3 0x561f93769588 in hermes::irgen::ESTreeIRGen::_genExpressionImpl(hermes::ESTree::Node*, hermes::Identifier) /home/ubuntu/hermes/lib/IRGen/ESTreeIRGen-expr.cpp:181
#4 0x561f937686d0 in hermes::irgen::ESTreeIRGen::genExpression(hermes::ESTree::Node*, hermes::Identifier) /home/ubuntu/hermes/lib/IRGen/ESTreeIRGen-expr.cpp:44
#5 0x561f937ab26b in hermes::irgen::ESTreeIRGen::genExpressionWrapper(hermes::ESTree::Node*) /home/ubuntu/hermes/lib/IRGen/ESTreeIRGen-stmt.cpp:231
#6 0x561f937aa04f in hermes::irgen::ESTreeIRGen::genStatement(hermes::ESTree::Node*) /home/ubuntu/hermes/lib/IRGen/ESTreeIRGen-stmt.cpp:65
#7 0x561f937aa247 in hermes::irgen::ESTreeIRGen::genStatement(hermes::ESTree::Node*) /home/ubuntu/hermes/lib/IRGen/ESTreeIRGen-stmt.cpp:82
#8 0x561f937d32d6 in hermes::irgen::ESTreeIRGen::genBasicFunction(hermes::Identifier, hermes::ESTree::FunctionLikeNode*, hermes::VariableScope*, hermes::ESTree::Node*, hermes::Function::DefinitionKind, hermes::Variable*, hermes::ESTree::Node*)::{lambda()#1}::operator()() const (/home/ubuntu/asan_build/bin/hermes+0x9652d6)
#9 0x561f937ef03f in void std::__invoke_impl(std::__invoke_other, hermes::irgen::ESTreeIRGen::genBasicFunction(hermes::Identifier, hermes::ESTree::FunctionLikeNode*, hermes::VariableScope*, hermes::ESTree::Node*, hermes::Function::DefinitionKind, hermes::Variable*, hermes::ESTree::Node*)::{lambda()#1}&) (/home/ubuntu/asan_build/bin/hermes+0x98103f)
#10 0x561f937ee0be in std::enable_if, void>::type std::__invoke_r(hermes::irgen::ESTreeIRGen::genBasicFunction(hermes::Identifier, hermes::ESTree::FunctionLikeNode*, hermes::VariableScope*, hermes::ESTree::Node*, hermes::Function::DefinitionKind, hermes::Variable*, hermes::ESTree::Node*)::{lambda()#1}&) (/home/ubuntu/asan_build/bin/hermes+0x9800be)
#11 0x561f937ec875 in std::_Function_handler::_M_invoke(std::_Any_data const&) (/home/ubuntu/asan_build/bin/hermes+0x97e875)
#12 0x561f93748865 in std::function::operator()() const /usr/include/c++/11/bits/std_function.h:590
#13 0x561f937415d5 in hermes::irgen::ESTreeIRGen::drainCompilationQueue() /home/ubuntu/hermes/lib/IRGen/ESTreeIRGen.cpp:1460
#14 0x561f93732671 in hermes::irgen::ESTreeIRGen::doIt(llvh::StringRef) (/home/ubuntu/asan_build/bin/hermes+0x8c4671)
#15 0x561f9372a4b7 in hermes::generateIRFromESTree(hermes::Module*, hermes::sema::SemContext&, hermes::flow::FlowContext&, hermes::ESTree::Node*, llvh::StringRef) /home/ubuntu/hermes/lib/IRGen/IRGen.cpp:29
#16 0x561f93398e07 in (anonymous namespace)::processSourceFiles(std::shared_ptr, std::map >, std::less, std::allocator > > > >) (/home/ubuntu/asan_build/bin/hermes+0x52ae07)
#17 0x561f9339d239 in hermes::driver::compileFromCommandLineOptions() (/home/ubuntu/asan_build/bin/hermes+0x52f239)
#18 0x561f9345f046 in main /home/ubuntu/hermes/tools/hermes/hermes.cpp:259
#19 0x7fcaea769d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#20 0x7fcaea769e3f in __libc_start_main_impl ../csu/libc-start.c:392
#21 0x561f93374b34 in _start (/home/ubuntu/asan_build/bin/hermes+0x506b34)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/ubuntu/hermes/include/hermes/IR/IR.h:1376 in hermes::Variable::getParent() const
==286619==ABORTING
```
Contributor guide
Research direction
Run the supplied JavaScript POC with the ASAN Hermes build and trace the failure from hermes::Variable::getParent in include/hermes/IR/IR.h through ESTreeIRGen::createLRef and genUpdateExpr in lib/IRGen/ESTreeIRGen-expr.cpp. Done means this input no longer produces the reported AddressSanitizer SEGV.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, javascript
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100