Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' in parser_parse_object_initializer

[owl337]

JerryScript revision

d06c3a7

Build platform

Ubuntu 16.04.6 LTS (Linux 4.15.0-99-generic x86_64)

Build steps

python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g \
--error-messages=on --debug --compile-flag=-g --strip=off --logging=on \
--compile-flag=-fsanitize=address --stack-limit=15

Test case

function f ({array, 'a', { value: 'foo', enumerable: true } : 36})
{}

Output

ICE: Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' failed at /home/JerryScript/jerryscript/jerry-core/parser/js/js-parser-expr.c(parser_parse_object_initializer):3230.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted (core dumped)

Credits: This vulnerability is detected by chong from OWL337.