chakra-core / chakra-core/ChakraCore
ASSERTION (skipAssert || value == nullptr || *value == property) failed in Js::JavascriptOperators::GetProperty_Internal
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
###### ChakraCore version:
```
Checked revision: a247f4f3c
Build command: ./build.sh --debug
```
###### OS:
```
Linux-4.15.0-43-generic-x86_64-with-Ubuntu-18.04-bionic
```
###### Test case:
```js
var obj = {};
Object.defineProperty(obj, "test", {
get: function() {
delete obj.test;
obj.test = 0;
return Object.create(this)
},
configurable: true
});
WScript(obj.test);
```
###### Backtrace:
```text
ASSERTION 15161: (ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp, line 1931) skipAssert || value == nullptr || *value == property
Failure: (skipAssert || value == nullptr || *value == property)
Thread 1 "ch" received signal SIGILL, Illegal instruction.
0x00007ffff35e0c90 in Js::JavascriptOperators::GetProperty_Internal (instance=0x7ffff7ea52a0, propertyObject=
0x7ffff7ea52a0, isRoot=false, propertyId=346, value=0x7fffffff8fd8, requestContext=0x5555561b2ac8, info=0x7fffffff9028)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:1931
1931 Assert(skipAssert || value == nullptr || *value == property);
(gdb) bt
#0 0x00007ffff35e0c90 in Js::JavascriptOperators::GetProperty_Internal (instance=0x7ffff7ea52a0,
propertyObject=0x7ffff7ea52a0, isRoot=false, propertyId=346, value=0x7fffffff8fd8, requestContext=0x5555561b2ac8,
info=0x7fffffff9028) at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:1931
#1 0x00007ffff35b2503 in Js::JavascriptOperators::GetProperty (instance=0x7ffff7ea52a0, propertyObject=0x7ffff7ea52a0,
propertyId=346, value=0x7fffffff8fd8, requestContext=0x5555561b2ac8, info=0x7fffffff9028)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:1830
#2 0x00007ffff35d3afa in Js::JavascriptOperators::GetProperty (instance=0x7ffff7ea52a0, propertyObject=0x7ffff7ea52a0,
propertyId=346, requestContext=0x5555561b2ac8, info=0x7fffffff9028)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:11150
#3 0x00007ffff35d49e9 in Js::JavascriptOperators::PatchGetValueWithThisPtrNoFastPath (functionBody=0x7ffff7eab000,
inlineCache=0x7ffff7e88050, inlineCacheIndex=3, instance=0x7ffff7ea52a0, propertyId=346, thisInstance=0x7ffff7ea52a0)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:8021
#4 0x00007ffff363f203 in Js::ProfilingHelpers::ProfiledLdFld (instance=0x7ffff7ea52a0, propertyId=346,
inlineCache=0x7ffff7e88050, inlineCacheIndex=3, functionBody=0x7ffff7eab000, thisInstance=0x7ffff7ea52a0)
at ChakraCore/lib/Runtime/Language/ProfilingHelpers.cpp:995
#5 0x00007ffff35862e5 in Js::InterpreterStackFrame::ProfiledGetProperty > const __unaligned, false, false, false>(Js::OpLayoutT_ElementCP > const __unaligned __unaligned*, void*) (this=0x7fffffffc410, playout=0x7ffff7e8706e, instance=0x7ffff7ea52a0)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:4058
#6 0x00007ffff354c732 in Js::InterpreterStackFrame::OP_ProfiledGetProperty > const __unaligned>(Js::OpLayoutT_ElementCP > const __unaligned __unaligned*) (
this=0x7fffffffc410, playout=0x7ffff7e8706e)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:4231
#7 0x00007ffff3400d2c in Js::InterpreterStackFrame::ProcessProfiled (this=0x7fffffffc410)
at ChakraCore/lib/Runtime/Language/InterpreterHandler.inl:165
#8 0x00007ffff338d59d in Js::InterpreterStackFrame::Process (this=0x7fffffffc410)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3357
#9 0x00007ffff338c307 in Js::InterpreterStackFrame::InterpreterHelper (function=0x7ffff7f066e0, args=...,
returnAddress=0x7ffff7e60fa2, addressOfReturnAddress=0x7fffffffc978, asmJsReturn=0x0)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:2051
#10 0x00007ffff338b4d8 in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7fffffffc990)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:1763
#11 0x00007ffff7e60fa2 in ?? ()
#12 0x00007fffffffc9a0 in ?? ()
#13 0x00007ffff3ab445e in amd64_CallFunction ()
at ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
```
Found by [Fuzzinator](http://fuzzinator.readthedocs.io/) with [grammarinator](https://github.com/renatahodovan/grammarinator).
Contributor guide
Assessment
This issue has not been assessed yet.