ChakraCore icon indicating copy to clipboard operation
ChakraCore copied to clipboard

Assertion failure in InlineCache.inl

Open zhunki opened this issue 3 years ago • 0 comments

the following poc cause a assertion failure in "debug" build on ubuntu.

function v0(v1,v2) {
    v2.length = 1;
    return v2;
}
function v4(v5,v6) {
}
const v8 = new v4();
function v9(v10,v11) {
    v11.__proto__ = v8;
    return v11;
}
const v12 = v9(undefined,v4);
v12[-65537] = v9;
const opt = v0;let p0 = v12;let p1 = v12;

zhunki avatar Dec 24 '21 11:12 zhunki