Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed src/mjs_gc.c:354: gc_mark_string.

[hope-fly]

mJS revision

Commit: b1b6eac

Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)

Build steps

vim Makefile
DOCKER_GCC=gcc
DOCKER_CLANG=clang
$(DOCKER_GCC) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make

Test case

poc.js

(function () {
  ((function f(a) {
    if (a > 0) {
      if (gc(JSON.stringify({
        translate: ({
          enumerable: [
            !Object.create
          ]
        })
      })) !== f("switch(''){default:break;/*DUPTRY525*/}")('#1.1: -0 - -0 === 0. Actual: ' !== f(a - 1))) {
        f(a - 1)
      }
    }
  })(6))
})()

Execution steps & Output

$ ./mjs/build/mjs poc.js
mjs: src/mjs_gc.c:354: gc_mark_string: Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed.
[1]    68013 abort      mjs poc.js

Credits: Found by OWL337 team.