ChakraCore icon indicating copy to clipboard operation
ChakraCore copied to clipboard

Assertion failure in Backend/Lower.cpp

Open zhunki opened this issue 3 years ago • 0 comments

the following poc cause a assertion failure in "debug" build on ubuntu.

function main() {
const v0 = async () => {
    const v1 = `       
        const v2 = [..."-2147483647"];
        for (const v3 of v2) {
            for (let v4 = 0; v4 < 9; v4++) {
                const v5 = () => {
                    const v6 = \`\`;
                    const v7 = eval(v6);
                    for (const v8 in v3) {
                        const v9 = {"call":Symbol};
                        v9.toString = Symbol;
                        for (let v10 = 0; v10 < 8; v10++) {}
                        const v11 = [NaN];
                    }
                };
                const v12 = v5();
            }
        }
        const v13 = [NaN];
    `;
    const v14 = eval(v1);
};

const v15 = [4];
const v16 = v15["map"](v0);
}
main();

zhunki avatar Dec 28 '21 06:12 zhunki