NULL pointer dereference in function getLiveInValue, file lib/Optimizer/Scalar/Mem2Reg.cpp

[djuricmilan]

Bug Description

Hermes git revision (if applicable): 86d391d
React Native version: N/A
OS: 5.15.0-101-generic #111-Ubuntu SMP x86_64 GNU/Linux
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): x86_64

Steps To Reproduce

1. Build hermes from source (I used clang16) from the associated commit (86d391d) with ASAN and the following cmake flags:
   "-DHERMES_ENABLE_LIBFUZZER=1"
   "-DHERMES_ENABLE_WERROR=0"
   "-DHERMES_THREAD_SAFETY_ANALYSIS=0"
   "-DHERMES_ENABLE_TEST_SUITE=0"
2. Run hermes with the JS PoC available in this archive: ASAN_002982741_fuzzer_1.zip

PoC:

 yield [1,2,3] !==  function  from( { [ new as ( )]: []  }  , as   ) { } ( )  
 { } 

ASAN trace:

> ./hermes ASAN_002982741_fuzzer_1
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3068628==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x556aa3a80891 bp 0x60d0000018a0 sp 0x7fff3ab5e060 T0)
==3068628==The signal is caused by a READ memory access.
==3068628==Hint: address points to the zero page.
    #0 0x556aa3a80891  (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x757891)
    #1 0x556aa3a53094  (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x72a094)
    #2 0x556aa3813913  (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x4ea913)
    #3 0x556aa34e369a  (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x1ba69a)
    #4 0x7fa66935ffcd  (/nix/store/j0by58xwyc66f884x0q8rpzvgpwvjmf2-glibc-2.38-77/lib/libc.so.6+0x27fcd) (BuildId: 988e7c95904375296e2763be4c7b5406afce4f5a)
    #5 0x7fa669360088  (/nix/store/j0by58xwyc66f884x0q8rpzvgpwvjmf2-glibc-2.38-77/lib/libc.so.6+0x28088) (BuildId: 988e7c95904375296e2763be4c7b5406afce4f5a)
    #6 0x556aa33b5ac4  (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x8cac4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/nix/store/xc0c5xlp0q7fwn7gd2l42x57r4jgbc4x-target_final/bin/hermes+0x757891) 
==3068628==ABORTING

Backtrace

The NULL pointer dereference is caused because IDom points to 0x0:

hermes/lib/Optimizer/Scalar/Mem2Reg.cpp

Line 592 in 86d391d

return getLiveOutValue(IDom->getBlock(), phiLoc, DT, stores);

Notes

Possibly duplicate of: #1357