facebook / facebook/hermes

Assertion failure in IRGen/ESTreeIRGen-expr.cpp: "SemanticResolver must check super() is in a class with a superclass"

Open
#2,126 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
11.3k
Forks
859
Avg merge
1h 30m
Merged PRs (30d)
3

Description

## Bug Description

Hello, I found this crash in Hermes where valid JavaScript triggers an assertion failure

Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/aa4dc53995121184faadceecf2d9d0a535f962c7, the latest commit on static_h
OS: Linux

## Steps To Reproduce

1. build the debug version of the Hermes CLI
2. run `hermes crash.js`

crash.js
```js
class A {}
new class extends A {
constructor() {
(async(a = super(), b) => {
})();
}
}
```

output:
```sh
hermes: hermes/lib/IRGen/ESTreeIRGen-expr.cpp:565: hermes::Value* hermes::irgen::ESTreeIRGen::genCallExpr(hermes::ESTree::CallExpressionNode*): Assertion `curFunction()->superClassNode_ && "SemanticResolver must check super() is in a class with a superclass"' failed.
```

backtrace:
```sh
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007ffff704527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007ffff70288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ffff702881b in __assert_fail_base (fmt=0x7ffff71d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
assertion=assertion@entry=0x5555561f49a0 "curFunction()->superClassNode_ && \"SemanticResolver must check super() is in a class with a superclass\"",
file=file@entry=0x5555561f45b0 "hermes/lib/IRGen/ESTreeIRGen-expr.cpp", line=line@entry=565,
function=function@entry=0x5555561f4940 "hermes::Value* hermes::irgen::ESTreeIRGen::genCallExpr(hermes::ESTree::CallExpressionNode*)") at ./assert/assert.c:96
#6 0x00007ffff703b517 in __assert_fail (assertion=0x5555561f49a0 "curFunction()->superClassNode_ && \"SemanticResolver must check super() is in a class with a superclass\"",
file=0x5555561f45b0 "hermes/lib/IRGen/ESTreeIRGen-expr.cpp", line=565, function=0x5555561f4940 "hermes::Value* hermes::irgen::ESTreeIRGen::genCallExpr(hermes::ESTree::CallExpressionNode*)")
at ./assert/assert.c:105
#7 0x00005555558788fe in hermes::irgen::ESTreeIRGen::genCallExpr (this=0x7fffffffcad0, call=0x555556c47060) at hermes/lib/IRGen/ESTreeIRGen-expr.cpp:565
#8 0x0000555555876881 in hermes::irgen::ESTreeIRGen::_genExpressionImpl (this=0x7fffffffcad0, expr=0x555556c47060, nameHint=...) at hermes/lib/IRGen/ESTreeIRGen-expr.cpp:113
#9 0x00005555558762f5 in hermes::irgen::ESTreeIRGen::genExpression (this=0x7fffffffcad0, expr=0x555556c47060, nameHint=...) at hermes/lib/IRGen/ESTreeIRGen-expr.cpp:45
#10 0x0000555555862655 in hermes::irgen::ESTreeIRGen::emitOptionalInitialization (this=0x7fffffffcad0, value=0x555556c56ca0, init=0x555556c47060, nameHint=...) at hermes/lib/IRGen/ESTreeIRGen.cpp:1524
#11 0x00005555558b1a74 in hermes::irgen::ESTreeIRGen::emitParameters (this=0x7fffffffcad0, funcNode=0x555556c47240) at hermes/lib/IRGen/ESTreeIRGen-func.cpp:1189
#12 0x00005555558b02d3 in hermes::irgen::ESTreeIRGen::emitFunctionDeclarations (this=0x7fffffffcad0, funcNode=0x555556c47240) at hermes/lib/IRGen/ESTreeIRGen-func.cpp:880
#13 0x00005555558b026e in hermes::irgen::ESTreeIRGen::emitFunctionPrologue (this=0x7fffffffcad0, funcNode=0x555556c47240, entry=0x555556c55a80,
doInitES5CaptureState=hermes::irgen::ESTreeIRGen::InitES5CaptureState::No, doEmitDeclarations=hermes::irgen::ESTreeIRGen::DoEmitDeclarations::Yes, parentScope=0x555556c55770)
at hermes/lib/IRGen/ESTreeIRGen-func.cpp:874
#14 0x00005555558ad62f in operator() (__closure=0x555556c56270) at hermes/lib/IRGen/ESTreeIRGen-func.cpp:284
#15 0x00005555558bbdb4 in std::__invoke_impl&>(std::__invoke_other, struct {...} &) (__f=...) at /usr/include/c++/13/bits/invoke.h:61
#16 0x00005555558bb42e in std::__invoke_r&>(struct {...} &) (__fn=...) at /usr/include/c++/13/bits/invoke.h:111
#17 0x00005555558bac0d in std::_Function_handler >::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/13/bits/std_function.h:290
#18 0x00005555556c16b2 in std::function::operator() (this=0x555556c4a540) at /usr/include/c++/13/bits/std_function.h:591
#19 0x00005555558636be in hermes::irgen::ESTreeIRGen::drainCompilationQueue (this=0x7fffffffcad0) at hermes/lib/IRGen/ESTreeIRGen.cpp:1701
#20 0x000055555585b6eb in hermes::irgen::ESTreeIRGen::doIt (this=0x7fffffffcad0, topLevelFunctionName=...) at hermes/lib/IRGen/ESTreeIRGen.cpp:215
#21 0x0000555555857b59 in hermes::generateIRFromESTree (M=0x555556c37450, semCtx=..., flowContext=..., node=0x555556c47620, topLevelFunctionName=...) at hermes/lib/IRGen/IRGen.cpp:29
#22 0x0000555555672dd8 in (anonymous namespace)::processSourceFiles (context=std::shared_ptr (use count 3, weak count 0) = {...}, fileBufs=std::map with 1 element = {...})
at hermes/lib/CompilerDriver/CompilerDriver.cpp:2083
#23 0x0000555555674cbb in hermes::driver::compileFromCommandLineOptions () at hermes/lib/CompilerDriver/CompilerDriver.cpp:2397
#24 0x00005555556d22ea in main (argc=2, argv=0x7fffffffe188) at hermes/tools/hermes/hermes.cpp:303
```

## The Expected Behavior
There should be no crash as the code is valid.

Contributor guide

Open the contributing guide

Research direction

First reproduce the crash by building the debug Hermes CLI and running it with the provided crash.js input. Then inspect lib/IRGen/ESTreeIRGen-expr.cpp at genCallExpr line 565 and trace the SemanticResolver check mentioned by the assertion; done means this valid JavaScript compiles without an assertion failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, javascript
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.