Assertion '(c & LIT_UTF8_3_BYTE_MASK) == LIT_UTF8_3_BYTE_MARKER' in lit_read_code_unit_from_utf8

[ossy-szeged]

JerryScript revision

0c15430
(latest master - 2020.08.11.)

Build platform

Ubuntu 18.04.5 LTS (Linux 4.15.0-112-generic x86_64)

Build steps

tools/build.py --debug --logging=on --error-messages=on --line-info=on

Test case

official test262-esnext test case: built-ins/JSON/stringify/value-string-escape-unicode.js

echo "'use strict';" >test.js
cat tests/test262/esnext/harness/sta.js tests/test262/esnext/harness/assert.js tests/test262/esnext/test/built-ins/JSON/stringify/value-string-escape-unicode.js >>test.js

$build/bin/jerry test.js

Note: This test fails only on debug build and only in strict mode. After changing the test, eg commenting sub-cases, the assert goes away.

Output

ICE: Assertion '(c & LIT_UTF8_3_BYTE_MASK) == LIT_UTF8_3_BYTE_MARKER' failed at /home/oszi/jerryscript/jerry-core/lit/lit-strings.c(lit_read_code_unit_from_utf8):447.
Error: ERR_FAILED_INTERNAL_ASSERTION

Backtrace

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff7a248b1 in __GI_abort () at abort.c:79
#2  0x000055555555f5e4 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at /home/oszi/jerryscript/jerry-port/default/default-fatal.c:30
#3  0x00005555555af128 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at /home/oszi/jerryscript/jerry-core/jrt/jrt-fatals.c:63
#4  0x00005555555af17a in jerry_assert_fail (assertion=0x555555622058 "(c & LIT_UTF8_3_BYTE_MASK) == LIT_UTF8_3_BYTE_MARKER", file=0x555555621f80 "/home/oszi/jerryscript/jerry-core/lit/lit-strings.c", function=0x55555560d570 <__func__.2773.lto_priv.581> "lit_read_code_unit_from_utf8", line=447) at /home/oszi/jerryscript/jerry-core/jrt/jrt-fatals.c:87
#5  0x00005555555b1826 in lit_read_code_unit_from_utf8 (buf_p=0x55555584514a <jerry_global_heap+3746> "\206\355\240\264\355\274\250\001\024\002*\002-\002`\017", code_point=0x7fffffffdb4e) at /home/oszi/jerryscript/jerry-core/lit/lit-strings.c:447
#6  0x00005555555b1a31 in lit_cesu8_peek_next (buf_p=0x55555584514a <jerry_global_heap+3746> "\206\355\240\264\355\274\250\001\024\002*\002-\002`\017") at /home/oszi/jerryscript/jerry-core/lit/lit-strings.c:522
#7  0x00005555555ee666 in ecma_builtin_json_quote (builder_p=0x7fffffffdd18, string_p=0x555555845138 <jerry_global_heap+3728>) at /home/oszi/jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:861
#8  0x00005555555ef2c2 in ecma_builtin_json_serialize_property (context_p=0x7fffffffdcf0, holder_p=0x555555844998 <jerry_global_heap+1776>, key_p=0xd) at /home/oszi/jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:1326
#9  0x00005555555ef566 in ecma_builtin_json_str_helper (context_p=0x7fffffffdcf0, arg1=3729) at /home/oszi/jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:1419
#10 0x00005555555efd1a in ecma_builtin_json_stringify (this_arg=1259, arg1=3729, arg2=72, arg3=72) at /home/oszi/jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.c:1694
#11 0x00005555555ed390 in ecma_builtin_json_dispatch_routine (builtin_routine_id=91, this_arg_value=1259, arguments_list=0x7fffffffde24, arguments_number=1) at /home/oszi/jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-json.inc.h:34
#12 0x00005555555f188c in ecma_builtin_dispatch_routine (func_obj_p=0x5555558447a0 <jerry_global_heap+1272>, this_arg_value=1259, arguments_list_p=0x7fffffffde24, arguments_list_len=1) at /home/oszi/jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1181
#13 0x00005555555f19c3 in ecma_builtin_dispatch_call (obj_p=0x5555558447a0 <jerry_global_heap+1272>, this_arg_value=1259, arguments_list_p=0x7fffffffe080, arguments_list_len=1) at /home/oszi/jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:1205
#14 0x00005555555deb90 in ecma_op_function_call_simple (func_obj_p=0x5555558447a0 <jerry_global_heap+1272>, this_arg_value=1259, arguments_list_p=0x7fffffffe080, arguments_list_len=1) at /home/oszi/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:846
#15 0x00005555555df2fa in ecma_op_function_call (func_obj_p=0x5555558447a0 <jerry_global_heap+1272>, this_arg_value=1259, arguments_list_p=0x7fffffffe080, arguments_list_len=1) at /home/oszi/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1143
#16 0x00005555555a4183 in opfunc_call.lto_priv.496 (frame_ctx_p=0x7fffffffe020) at /home/oszi/jerryscript/jerry-core/vm/vm.c:779
#17 0x000055555558bc3d in vm_execute (frame_ctx_p=0x7fffffffe020) at /home/oszi/jerryscript/jerry-core/vm/vm.c:4699
#18 0x000055555558be7e in vm_run (bytecode_header_p=0x555555845700 <jerry_global_heap+5208>, this_binding_value=27, lex_env_p=0x5555558442d8 <jerry_global_heap+48>, arg_list_p=0x0, arg_list_len=0) at /home/oszi/jerryscript/jerry-core/vm/vm.c:4801
#19 0x00005555555a37f4 in vm_run_global (bytecode_p=0x555555845700 <jerry_global_heap+5208>) at /home/oszi/jerryscript/jerry-core/vm/vm.c:340
#20 0x00005555555f8749 in jerry_run (func_val=267) at /home/oszi/jerryscript/jerry-core/api/jerry.c:589
#21 0x00005555555f5cd5 in main (argc=2, argv=0x7fffffffe4c8) at /home/oszi/jerryscript/jerry-main/main-unix.c:123

[galpeter]

Probably a smaller test case, but it only shows with ASAN/valgrind
Compile with ./tools/build.py --debug --compile-flag=-fsanitize=address --compile-flag=-m32 --system-allocator=on --lto=off

Test case:

JSON.stringify("\uD834")

ASAN report:

=================================================================
==56023==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf4d006df at pc 0x56660fdd bp 0xffc17e68 sp 0xffc17e58
READ of size 1 at 0xf4d006df thread T0
    #0 0x56660fdc in lit_read_code_unit_from_utf8 jerry-core/lit/lit-strings.c:431
    #1 0x566616cb in lit_cesu8_peek_next jerry-core/lit/lit-strings.c:522
    #2 0x56604253 in ecma_builtin_json_quote jerry-core/ecma/builtin-objects/ecma-builtin-json.c:861
    #3 0x56605a9c in ecma_builtin_json_serialize_property jerry-core/ecma/builtin-objects/ecma-builtin-json.c:1326
    #4 0x56605e94 in ecma_builtin_json_str_helper jerry-core/ecma/builtin-objects/ecma-builtin-json.c:1419
    #5 0x56606efc in ecma_builtin_json_stringify jerry-core/ecma/builtin-objects/ecma-builtin-json.c:1694
    #6 0x56601847 in ecma_builtin_json_dispatch_routine jerry-core/ecma/builtin-objects/ecma-builtin-json.inc.h:34
    #7 0x5660a8ef in ecma_builtin_dispatch_routine jerry-core/ecma/builtin-objects/ecma-builtins.c:1181
    #8 0x5660aaac in ecma_builtin_dispatch_call jerry-core/ecma/builtin-objects/ecma-builtins.c:1205
    #9 0x5662c3d3 in ecma_op_function_call_simple jerry-core/ecma/operations/ecma-function-object.c:846
    #10 0x5662d32d in ecma_op_function_call jerry-core/ecma/operations/ecma-function-object.c:1143
    #11 0x5669d14f in opfunc_call jerry-core/vm/vm.c:779
    #12 0x566b4a1d in vm_execute jerry-core/vm/vm.c:4699
    #13 0x566b4fd9 in vm_run jerry-core/vm/vm.c:4801
    #14 0x5669b815 in vm_run_global jerry-core/vm/vm.c:340
    #15 0x565d0926 in jerry_run jerry-core/api/jerry.c:589
    #16 0x565c9c7d in main jerry-main/main-unix.c:123
    #17 0xf7798efd in __libc_start_main (/usr/lib32/libc.so.6+0x1eefd)
    #18 0x565c9424 in _start (build/bin/jerry+0x1b424)

0xf4d006df is located 0 bytes to the right of 15-byte region [0xf4d006d0,0xf4d006df)
allocated by thread T0 here:
    #0 0xf7a188f5 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x5665c01d in jmem_heap_alloc jerry-core/jmem/jmem-heap.c:254
    #2 0x5665c119 in jmem_heap_gc_and_alloc_block jerry-core/jmem/jmem-heap.c:291
    #3 0x5665c1ac in jmem_heap_alloc_block jerry-core/jmem/jmem-heap.c:325
    #4 0x566b526c in ecma_alloc_string_buffer jerry-core/ecma/base/ecma-alloc.c:222
    #5 0x565e8a4d in ecma_new_ecma_string_from_utf8_buffer jerry-core/ecma/base/ecma-helpers-string.c:269
    #6 0x565e8a4d in ecma_new_ecma_string_from_utf8 jerry-core/ecma/base/ecma-helpers-string.c:354
    #7 0x565fe7af in ecma_find_or_create_literal_string jerry-core/ecma/base/ecma-literal-storage.c:170
    #8 0x56663433 in parser_compute_indicies jerry-core/parser/js/js-parser.c:146
    #9 0x566654c4 in parser_post_processing jerry-core/parser/js/js-parser.c:1040
    #10 0x5666c985 in parser_parse_source jerry-core/parser/js/js-parser.c:2324
    #11 0x5667047d in parser_parse_script jerry-core/parser/js/js-parser.c:2938
    #12 0x565d0560 in jerry_parse jerry-core/api/jerry.c:451
    #13 0x565c9b28 in main jerry-main/main-unix.c:112
    #14 0xf7798efd in __libc_start_main (/usr/lib32/libc.so.6+0x1eefd)

SUMMARY: AddressSanitizer: heap-buffer-overflow jerry-core/lit/lit-strings.c:431 in lit_read_code_unit_from_utf8
Shadow bytes around the buggy address:
  0x3e9a0080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3e9a0090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3e9a00a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3e9a00b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3e9a00c0: fa fa fa fa fa fa fa fa fa fa 00 02 fa fa fd fd
=>0x3e9a00d0: fa fa 00 00 fa fa 00 01 fa fa 00[07]fa fa fd fa
  0x3e9a00e0: fa fa fd fd fa fa 00 00 fa fa 00 06 fa fa 00 03
  0x3e9a00f0: fa fa 00 07 fa fa 00 00 fa fa fa fa fa fa fa fa
  0x3e9a0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3e9a0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3e9a0120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==56023==ABORTING