ChakraCore icon indicating copy to clipboard operation
ChakraCore copied to clipboard

Assertion failure in FuncInfo.cpp

Open zhunki opened this issue 3 years ago • 0 comments

the following poc cause a assertion failure in "debug" build on ubuntu.

function main() {
const v4 = `
    const v214 = async (v215,...v216) => {
        const v219 = {"construct":v215,"defineProperty":v215,"deleteProperty":v205,"get":v215,"getOwnPropertyDescriptor":v215,"getPrototypeOf":v214,"isExtensible":Number,"ownKeys":undefined,"preventExtensions":Array,"setPrototypeOf":v215};
        const v221 = \`
            with (3820293751n) {
                const v223 = v214(null,5978n,4294967297,-12075807n);
                constructor = -536870912n;
            }
        \`;
    };
    const v225 = \`
        function v226(v227,v228,v229) {
            return -1005802608n;
            return -1046319162n;
        }
    \`;
    const v231 = \`
        const v233 = [-3290630866,-3290630866,1479576250n,6,-3290630866];
    \`;
    const v235 = \`
        function v236(v237,v238,v239) {
            return -1005802608n;
        }
    \`;
    const v246 = \`
        with (v41) {
            switch (Uint8ClampedArray) {
            default:
                break;
            case -3214534038n:
                break;
            case -2147483648n:
                break;
            case 6:
                break;
            case v246:
            }
            constructor = -536870912n;
            const v247 = Proxy && 256n;
        }
    \`;
    const v252 = \`
        function v253(v254,v255,v256) {
            return -1005802608n;
            return -268435456n;
        }
    \`;
    const v258 = \`
        function* v259(v260,v261) {
            yield* 8n;
        }
        const v263 = [-3290630866,-3290630866,1479576250n,2419694973n,-3290630866];
    \`;
    const v265 = \`
        function v266(v267,v268,v269) {
            return -1005802608n;
            return 256n;
        }
    \`;
    const v272 = \`
        const v273 = -1005802608n >= -1683432796;
    \`;

    const v295 = {};
    const v296 = \`
        const v297 = v296(...v295,...9007199254740993,-1005802608n);
    \`;
    const v301 = {};
    const v302 = [v301];
    const v303 = {};
    const v304 = [{}];
    const v308 = [150050.77584817936];
    const v309 = /\d(N*)?/gm;
    const v310 = /(H\W)/sium;
    async function v314(v315,v316,v317) {
        const v318 = {};
        v318[0] = BigInt;
    }
    const v320 = \`
        function v321(v322,v323,v324) {
            return 797151056n;
            return -9007199254740993n;
            return -4256153502n;
        }
    \`;
    function v669(v670,v671) {
        const v672 = \`
            function v673(v674,v675,v676) {
                return 65537n;
                return -1918956861n;
            }
        \`;
        const v678 = \`
            function v679(v680,v681,v682) {
                return -4139769482n;
            }
        \`;
        const v685 = (-3290630866).a;
        const v687 = \`
            const v689 = v685("entries",...v687,3961059690n);
        \`;
        const v690 = \`
            Symbol.toPrimitive = -1315759576n;
        \`;
        const v693 = \`
            switch (-9007199254740991n) {
            default:
                break;
            case 2147483649n:
            case -65536:
            }
        \`;
        for (let v700 = v672; v700 < -3679967650; v700 = v700 || 4) {
            const v701 = \`
                const v702 = 536870912n === v700;
            \`;
        }
        
        const v709 = \`
            const v710 = {}.join(Number,...-4294967295n);
        \`;
        const v711 = \`
            function v712(v713,v714,v715) {
                return -2851821453n;
                return -2457772485n;
                return 512n;
                return 65536n;
                return -128n;
                return 9007199254740991n;
            }
        \`;
        const v716 = v669();
    }
    const v718 = new Promise(v669);
    const v728 = \`
        with ([NaN,NaN]) {
            switch (isFinite) {
            default:
                valueOf = -2591578432n;
                break;
            case -3214534038n:
                break;
            case -3214534038n:
                break;
            case 6:
                break;
            case v728:
            }
            constructor = -536870912n;
        }
    \`;
`;
let v1212 = eval();
v1212 = eval;
const v1213 = v1212(v4);
}
main();

zhunki avatar Dec 28 '21 06:12 zhunki