Assertion 'size > 0 && ECMA_BIGINT_GET_LAST_DIGIT (value_p, size) != 0' failed at ./jerryscript/jerry-core/ecma/operations/ecma-big-uint.c

[JimWongM]

Hello, I found a crash in JerryScript.

JerryScript revision

5020015

Build platform

Ubuntu 22.04.3

Build steps

python3 tools/build.py --debug  --compile-flag=-fsanitize-coverage=trace-pc-guard --lto=off --compile-flag=-D_POSIX_C_SOURCE=200809 --compile-flag=-Wno-strict-prototypes --stack-limit=15 

Test case

var v1 = new Int16Array(1736);
var v2 = new Float64Array(v1);
var v3 = BigInt.asIntN(254145.65983098885, -4294967296n);
~ v3;

Output

ICE: Assertion 'size > 0 && ECMA_BIGINT_GET_LAST_DIGIT (value_p, size) != 0' failed at ./jerryscript/jerry-core/ecma/operations/ecma-big-uint.c(ecma_big_uint_increase):458.
Error: JERRY_FATAL_FAILED_ASSERTION
Aborted (core dumped)

Backtrace

(lldb) bt
* thread #1, name = 'jerry', stop reason = signal SIGABRT
  * frame #0: 0x00007ffff7c969fc libc.so.6`__GI___pthread_kill at pthread_kill.c:44:76
    frame #1: 0x00007ffff7c969b0 libc.so.6`__GI___pthread_kill [inlined] __pthread_kill_internal(signo=6, threadid=140737352689472) at pthread_kill.c:78:10
    frame #2: 0x00007ffff7c969b0 libc.so.6`__GI___pthread_kill(threadid=140737352689472, signo=6) at pthread_kill.c:89:10
    frame #3: 0x00007ffff7c42476 libc.so.6`__GI_raise(sig=6) at raise.c:26:13
    frame #4: 0x00007ffff7c287f3 libc.so.6`__GI_abort at abort.c:79:7
    frame #5: 0x00005555556cb400 jerry`jerry_port_fatal(code=JERRY_FATAL_FAILED_ASSERTION) at jerry-port-process.c:41:5
    frame #6: 0x0000555555619056 jerry`jerry_fatal(code=JERRY_FATAL_FAILED_ASSERTION) at jrt-fatals.c:63:3
    frame #7: 0x0000555555618ec1 jerry`jerry_assert_fail(assertion="size > 0 && ECMA_BIGINT_GET_LAST_DIGIT (value_p, size) != 0", file="/home/wjm/jerryscript/jerry-core/ecma/operations/ecma-big-uint.c", function="ecma_big_uint_increase", line=458) at jrt-fatals.c:83:3
    frame #8: 0x0000555555692950 jerry`ecma_big_uint_increase(value_p=0x0000555556085ca0) at ecma-big-uint.c:458:3
    frame #9: 0x00005555555df82c jerry`ecma_bigint_unary(value=50462, type=ECMA_BIGINT_UNARY_BITWISE_NOT) at ecma-bigint.c:1118:16
    frame #10: 0x0000555555644335 jerry`do_number_bitwise_not(value=50462) at opcodes-ecma-bitwise.c:203:28
    frame #11: 0x0000555555657d2d jerry`vm_loop(frame_ctx_p=0x00007fffffffdd10) at vm.c:3382:20
    frame #12: 0x000055555564dd19 jerry`vm_execute(frame_ctx_p=0x00007fffffffdd10) at vm.c:5230:37
    frame #13: 0x000055555564d22b jerry`vm_run(shared_p=0x00007fffffffde18, this_binding_value=11, lex_env_p=0x0000555556079880) at vm.c:5331:10
    frame #14: 0x000055555564d0e7 jerry`vm_run_global(bytecode_p=0x0000555556079c10, function_object_p=0x0000555556079a08) at vm.c:286:25
    frame #15: 0x000055555558ebe1 jerry`jerry_run(script=643) at jerryscript.c:549:24
    frame #16: 0x00005555556ca604 jerry`jerryx_source_exec_script(path_p="poc5.js") at sources.c:68:14
    frame #17: 0x000055555558a402 jerry`main(argc=2, argv=0x00007fffffffe0a8) at main-desktop.c:162:20
    frame #18: 0x00007ffff7c29d90 libc.so.6`__libc_start_call_main(main=(jerry`main at main-desktop.c:113), argc=2, argv=0x00007fffffffe0a8) at libc_start_call_main.h:58:16
    frame #19: 0x00007ffff7c29e40 libc.so.6`__libc_start_main_impl(main=(jerry`main at main-desktop.c:113), argc=2, argv=0x00007fffffffe0a8, init=<unavailable>, fini=<unavailable>, rtld_fini=<unavailable>, stack_end=0x00007fffffffe098) at libc-start.c:392:3
    frame #20: 0x00005555555617f5 jerry`_start + 37