Assertion failure in IRGen/ESTreeIRGen-expr.cpp: "SemanticResolver must check super() is in a class with a superclass"
- Dominant language
- JavaScript
- Stars
- 11.3k
- Forks
- 859
- Avg merge
- 1h 30m
- Merged PRs (30d)
- 3
Description
## Bug Description
Hello, I found this crash in Hermes where valid JavaScript triggers an assertion failure
Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/aa4dc53995121184faadceecf2d9d0a535f962c7, the latest commit on static_h
OS: Linux
## Steps To Reproduce
1. build the debug version of the Hermes CLI
2. run `hermes crash.js`
crash.js
```js
class A {}
new class extends A {
constructor() {
(async(a = super(), b) => {
})();
}
}
```
output:
```sh
hermes: hermes/lib/IRGen/ESTreeIRGen-expr.cpp:565: hermes::Value* hermes::irgen::ESTreeIRGen::genCallExpr(hermes::ESTree::CallExpressionNode*): Assertion `curFunction()->superClassNode_ && "SemanticResolver must check super() is in a class with a superclass"' failed.
```
backtrace:
```sh
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007ffff704527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007ffff70288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ffff702881b in __assert_fail_base (fmt=0x7ffff71d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
assertion=assertion@entry=0x5555561f49a0 "curFunction()->superClassNode_ && \"SemanticResolver must check super() is in a class with a superclass\"",
file=file@entry=0x5555561f45b0 "hermes/lib/IRGen/ESTreeIRGen-expr.cpp", line=line@entry=565,
function=function@entry=0x5555561f4940 "hermes::Value* hermes::irgen::ESTreeIRGen::genCallExpr(hermes::ESTree::CallExpressionNode*)") at ./assert/assert.c:96
#6 0x00007ffff703b517 in __assert_fail (assertion=0x5555561f49a0 "curFunction()->superClassNode_ && \"SemanticResolver must check super() is in a class with a superclass\"",
file=0x5555561f45b0 "hermes/lib/IRGen/ESTreeIRGen-expr.cpp", line=565, function=0x5555561f4940 "hermes::Value* hermes::irgen::ESTreeIRGen::genCallExpr(hermes::ESTree::CallExpressionNode*)")
at ./assert/assert.c:105
#7 0x00005555558788fe in hermes::irgen::ESTreeIRGen::genCallExpr (this=0x7fffffffcad0, call=0x555556c47060) at hermes/lib/IRGen/ESTreeIRGen-expr.cpp:565
#8 0x0000555555876881 in hermes::irgen::ESTreeIRGen::_genExpressionImpl (this=0x7fffffffcad0, expr=0x555556c47060, nameHint=...) at hermes/lib/IRGen/ESTreeIRGen-expr.cpp:113
#9 0x00005555558762f5 in hermes::irgen::ESTreeIRGen::genExpression (this=0x7fffffffcad0, expr=0x555556c47060, nameHint=...) at hermes/lib/IRGen/ESTreeIRGen-expr.cpp:45
#10 0x0000555555862655 in hermes::irgen::ESTreeIRGen::emitOptionalInitialization (this=0x7fffffffcad0, value=0x555556c56ca0, init=0x555556c47060, nameHint=...) at hermes/lib/IRGen/ESTreeIRGen.cpp:1524
#11 0x00005555558b1a74 in hermes::irgen::ESTreeIRGen::emitParameters (this=0x7fffffffcad0, funcNode=0x555556c47240) at hermes/lib/IRGen/ESTreeIRGen-func.cpp:1189
#12 0x00005555558b02d3 in hermes::irgen::ESTreeIRGen::emitFunctionDeclarations (this=0x7fffffffcad0, funcNode=0x555556c47240) at hermes/lib/IRGen/ESTreeIRGen-func.cpp:880
#13 0x00005555558b026e in hermes::irgen::ESTreeIRGen::emitFunctionPrologue (this=0x7fffffffcad0, funcNode=0x555556c47240, entry=0x555556c55a80,
doInitES5CaptureState=hermes::irgen::ESTreeIRGen::InitES5CaptureState::No, doEmitDeclarations=hermes::irgen::ESTreeIRGen::DoEmitDeclarations::Yes, parentScope=0x555556c55770)
at hermes/lib/IRGen/ESTreeIRGen-func.cpp:874
#14 0x00005555558ad62f in operator() (__closure=0x555556c56270) at hermes/lib/IRGen/ESTreeIRGen-func.cpp:284
#15 0x00005555558bbdb4 in std::__invoke_impl&>(std::__invoke_other, struct {...} &) (__f=...) at /usr/include/c++/13/bits/invoke.h:61
#16 0x00005555558bb42e in std::__invoke_r&>(struct {...} &) (__fn=...) at /usr/include/c++/13/bits/invoke.h:111
#17 0x00005555558bac0d in std::_Function_handler >::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/13/bits/std_function.h:290
#18 0x00005555556c16b2 in std::function::operator() (this=0x555556c4a540) at /usr/include/c++/13/bits/std_function.h:591
#19 0x00005555558636be in hermes::irgen::ESTreeIRGen::drainCompilationQueue (this=0x7fffffffcad0) at hermes/lib/IRGen/ESTreeIRGen.cpp:1701
#20 0x000055555585b6eb in hermes::irgen::ESTreeIRGen::doIt (this=0x7fffffffcad0, topLevelFunctionName=...) at hermes/lib/IRGen/ESTreeIRGen.cpp:215
#21 0x0000555555857b59 in hermes::generateIRFromESTree (M=0x555556c37450, semCtx=..., flowContext=..., node=0x555556c47620, topLevelFunctionName=...) at hermes/lib/IRGen/IRGen.cpp:29
#22 0x0000555555672dd8 in (anonymous namespace)::processSourceFiles (context=std::shared_ptr (use count 3, weak count 0) = {...}, fileBufs=std::map with 1 element = {...})
at hermes/lib/CompilerDriver/CompilerDriver.cpp:2083
#23 0x0000555555674cbb in hermes::driver::compileFromCommandLineOptions () at hermes/lib/CompilerDriver/CompilerDriver.cpp:2397
#24 0x00005555556d22ea in main (argc=2, argv=0x7fffffffe188) at hermes/tools/hermes/hermes.cpp:303
```
## The Expected Behavior
There should be no crash as the code is valid.
Contributor guide
Research direction
First reproduce the crash by building the debug Hermes CLI and running it with the provided crash.js input. Then inspect lib/IRGen/ESTreeIRGen-expr.cpp at genCallExpr line 565 and trace the SemanticResolver check mentioned by the assertion; done means this valid JavaScript compiles without an assertion failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, javascript
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100