{"action":"created","issue":{"url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5532","repository_url":"https://api.github.com/repos/Microsoft/ChakraCore","labels_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5532/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5532/comments","events_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5532/events","html_url":"https://github.com/Microsoft/ChakraCore/issues/5532","id":344797690,"node_id":"MDU6SXNzdWUzNDQ3OTc2OTA=","number":5532,"title":"null pointer dereference in EmitBooleanExpression","user":{"login":"zhunki","id":11497172,"node_id":"MDQ6VXNlcjExNDk3MTcy","avatar_url":"https://avatars3.githubusercontent.com/u/11497172?v=4","gravatar_id":"","url":"https://api.github.com/users/zhunki","html_url":"https://github.com/zhunki","followers_url":"https://api.github.com/users/zhunki/followers","following_url":"https://api.github.com/users/zhunki/following{/other_user}","gists_url":"https://api.github.com/users/zhunki/gists{/gist_id}","starred_url":"https://api.github.com/users/zhunki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhunki/subscriptions","organizations_url":"https://api.github.com/users/zhunki/orgs","repos_url":"https://api.github.com/users/zhunki/repos","events_url":"https://api.github.com/users/zhunki/events{/privacy}","received_events_url":"https://api.github.com/users/zhunki/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-26T11:04:38Z","updated_at":"2018-07-29T05:16:29Z","closed_at":null,"author_association":"NONE","body":"the following js code fragment can lead to a null pointer dereference.\r\n\r\nfunction g1()\r\n{\r\n    for (var i = 0;;++h)\r\n    {\r\n        for (var j =0;;++j)\r\n        {var a =0;}\r\n    }\r\n} \r\n\r\ng1();\r\n\r\n==10216==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55b703964384 bp 0x7ffd0824e480 sp 0x7ffd0824e430 T0)\r\n    #0 0x55b703964383 in EmitBooleanExpression(ParseNode*, int, int, ByteCodeGenerator*, FuncInfo*, bool, bool) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x170a383)\r\n    #1 0x55b703966025 in ByteCodeGenerator::EmitInvertedLoop(ParseNodeLoop*, ParseNodeFor*, FuncInfo*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x170c025)\r\n    #2 0x55b70392a05b in Emit(ParseNode*, ByteCodeGenerator*, FuncInfo*, int, bool, ParseNode*, bool) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x16d005b)\r\n    #3 0x55b703924439 in ByteCodeGenerator::EmitTopLevelStatement(ParseNode*, FuncInfo*, int) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x16ca439)\r\n    #4 0x55b703942582 in ByteCodeGenerator::EmitFunctionBody(FuncInfo*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x16e8582)\r\n    #5 0x55b703947d95 in ByteCodeGenerator::EmitOneFunction(ParseNodeFnc*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x16edd95)\r\n    #6 0x55b703942fa4 in ByteCodeGenerator::EmitScopeList(ParseNode*, ParseNode*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x16e8fa4)\r\n    #7 0x55b703942b77 in ByteCodeGenerator::EmitScopeList(ParseNode*, ParseNode*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x16e8b77)\r\n    #8 0x55b703942f91 in ByteCodeGenerator::EmitScopeList(ParseNode*, ParseNode*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x16e8f91)\r\n    #9 0x55b7029737a1 in ByteCodeGenerator::Generate(ParseNodeProg*, unsigned int, ByteCodeGenerator*, Js::ParseableFunctionInfo**, unsigned int, bool, Parser*, Js::ScriptFunction**) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x7197a1)\r\n    #10 0x55b70297a6c8 in GenerateByteCode(ParseNodeProg*, unsigned int, Js::ScriptContext*, Js::ParseableFunctionInfo**, unsigned int, bool, Parser*, CompileScriptException*, Js::ScopeInfo*, Js::ScriptFunction**) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x7206c8)\r\n    #11 0x55b7028eb29a in Js::ScriptContext::GenerateRootFunction(ParseNodeProg*, unsigned int, Parser*, unsigned int, CompileScriptException*, char16_t const*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x69129a)\r\n    #12 0x55b7028eb63d in Js::ScriptContext::LoadScript(unsigned char const*, unsigned long, SRCINFO const*, CompileScriptException*, Js::Utf8SourceInfo**, char16_t const*, LoadScriptFlag, void*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x69163d)\r\n    #13 0x55b7026c1fdf in RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x467fdf)\r\n    #14 0x55b7026cb85d in JsRun (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x47185d)\r\n    #15 0x55b7025d1f97 in RunScript(char const*, char const*, unsigned long, void (*)(void*), void*, char*, void*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x377f97)\r\n    #16 0x55b7025d3e72 in ExecuteTest(char const*) (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x379e72)\r\n    #17 0x55b7025d49f2 in main (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x37a9f2)\r\n    #18 0x7f70646fe82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291\r\n    #19 0x55b7024fbce8 in _start (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x2a1ce8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV (/media/b/ext/ChakraCore-1.10.0/out/Release/ch+0x170a383) in EmitBooleanExpression(ParseNode*, int, int, ByteCodeGenerator*, FuncInfo*, bool, bool)\r\n==10216==ABORTING"},"comment":{"url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/comments/408652743","html_url":"https://github.com/Microsoft/ChakraCore/issues/5532#issuecomment-408652743","issue_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5532","id":408652743,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODY1Mjc0Mw==","user":{"login":"fatcerberus","id":4097841,"node_id":"MDQ6VXNlcjQwOTc4NDE=","avatar_url":"https://avatars2.githubusercontent.com/u/4097841?v=4","gravatar_id":"","url":"https://api.github.com/users/fatcerberus","html_url":"https://github.com/fatcerberus","followers_url":"https://api.github.com/users/fatcerberus/followers","following_url":"https://api.github.com/users/fatcerberus/following{/other_user}","gists_url":"https://api.github.com/users/fatcerberus/gists{/gist_id}","starred_url":"https://api.github.com/users/fatcerberus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fatcerberus/subscriptions","organizations_url":"https://api.github.com/users/fatcerberus/orgs","repos_url":"https://api.github.com/users/fatcerberus/repos","events_url":"https://api.github.com/users/fatcerberus/events{/privacy}","received_events_url":"https://api.github.com/users/fatcerberus/received_events","type":"User","site_admin":false},"created_at":"2018-07-29T05:16:29Z","updated_at":"2018-07-29T05:16:29Z","author_association":"CONTRIBUTOR","body":"I tried but can't reproduce this - the script just runs indefinitely in both miniSphere and `ch` (ChakraCore 1.10.0)"}}
{"actor":{"display_login":"fatcerberus"}}