`attachFileToDiagnostics`: Debug Failure crash

[0xricksanchez]

🔎 Search Terms

Hi TypeScript team,

In an ongoing effort to secure the JS/TS ecosystem, we integrated the TypeScript project into Google's OSS-Fuzz project recently with our JS/TS fuzzer Jazzer.js.

Looking at the reports, it seems we were able to find another reproducer for what seems to be related to #46364, #44051, and #43832.

This bug has been found when building TypeScript from the main branch and running the fuzz_compiler.js link on it.

I attached a PoC below that isolates the issue to the call to ts.createSourceFile(fileName, fileContent, ts.ScriptTarget.Latest);.

Happy to answer any questions and also discuss the used APIs.

🕗 Version & Regression Information

• This is a crash

⏯ Playground Link

No response

💻 Code

Here's a quick JS reproducer.

const fs = require("fs");
const ts = require("typescript");

const ignored = [
  "is not a function"
];


class StringConsumer {
  constructor(filename) {
    if (filename) {

      this.data = fs.readFileSync(filename); // read file into byte buffer
    } else {
      this.data = Buffer.from([
        0x75, 0x40, 0x00, 0x6d, 0xc0, 0xc0, 0xbc, 0x28,
        0xfb, 0x70, 0xdb, 0xdb, 0xfb, 0x6d, 0x00, 0xdb,
        0x6f, 0x72, 0x74, 0x28, 0x40, 0xbc, 0xdb, 0xdb,
        0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x28, 0x6f,
        0x62, 0x6a, 0x75, 0x32, 0x63, 0x37, 0x37, 0x2c
      ]);
    }
    this.dataPtr = 0; // start index
    this._remainingBytes = this.data.length;
  }

  consumeString(maxLength, encoding = "ascii") {
    if (maxLength < 0) throw new Error("maxLength must be non-negative");
    let result;
    const arrayLength = Math.min(maxLength, this._remainingBytes);

    result = this.data.toString(encoding, this.dataPtr, this.dataPtr + arrayLength);

    this.dataPtr += arrayLength;
    this._remainingBytes -= arrayLength;

    return result;
  }
}

try {
  const provider = new StringConsumer();
  const fileName = provider.consumeString(10) + ".ts";
  const filePath = provider.consumeString(10) + "/" + fileName;
  const fileContent = provider.consumeString(100);
  console.log("fileName", fileName);
  console.log("filePath", filePath);
  console.log("fileContent", fileContent);

  ts.createSourceFile(fileName, fileContent, ts.ScriptTarget.Latest);
} catch (error) {
  if (!ignoredError(error)) {
    throw error;
  }
}

function ignoredError(error) {
  return !!ignored.find((message) => error.message.indexOf(message) !== -1);
}

🙁 Actual behavior

Verified locally on Node 18 LTS as well

node poc.js 
fileName u@m@@<({p.ts
filePath [[{m[ort(/u@m@@<({p.ts
fileContent @<[[import(obju2c77,
/Users/ci/Git/work/oss-fuzz-onboarding-projects/TypeScript/poc.js:53
    throw error;
    ^

Error: Debug Failure. Expected 21 <= 20
    at attachFileToDiagnostic (/Users/ci/Git/work/oss-fuzz-onboarding-projects/TypeScript/node_modules/typescript/lib/typescript.js:17846:17)
    at attachFileToDiagnostics (/Users/ci/Git/work/oss-fuzz-onboarding-projects/TypeScript/node_modules/typescript/lib/typescript.js:17858:36)
    at parseSourceFileWorker (/Users/ci/Git/work/oss-fuzz-onboarding-projects/TypeScript/node_modules/typescript/lib/typescript.js:28877:41)
    at Object.parseSourceFile (/Users/ci/Git/work/oss-fuzz-onboarding-projects/TypeScript/node_modules/typescript/lib/typescript.js:28700:26)
    at Object.createSourceFile (/Users/ci/Git/work/oss-fuzz-onboarding-projects/TypeScript/node_modules/typescript/lib/typescript.js:27885:23)
    at Object.<anonymous> (/Users/ci/Git/work/oss-fuzz-onboarding-projects/TypeScript/poc.js:50:6)
    at Module._compile (node:internal/modules/cjs/loader:1254:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1308:10)
    at Module.load (node:internal/modules/cjs/loader:1117:32)
    at Module._load (node:internal/modules/cjs/loader:958:12)

Node.js v18.16.0

🙂 Expected behavior

I assume not crash the Node.js runtime as is with the debug assertion?