chakra-core / chakra-core/ChakraCore
Assertion failure at lib/Runtime/Language/InlineCache.h:471
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
The following code will trigger an assertion failure:
```
function main() {
const v1 = [0x1337,0x1337,0x1337,0x1337,0x1337];
function v10(v11,v12,v13) {
return 1;
}
const v9 = [0x1330, 0x1330, 0x1330];
const v14 = {get:v10};
const v16 = new Proxy(v9,v14);
const v18 = [0x1338];
const v19 = v18.__proto__;
for (let v5 = 0; v5 < 2; v5++) {
const v6 = v1.fround;
v19.__proto__ = v16;
}
console.log(v19.__proto__);
}
main();
```
```
(/home/ChakraCore/lib/Runtime/./Language/InlineCache.h, line 471) *propertyValue == slowPathValue || (VarIs(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal())
Failure: (*propertyValue == slowPathValue || (VarIs(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal()))
```
It seems to fetch from the wrong cache.
Contributor guide
Assessment
This issue has not been assessed yet.