chakra-core / chakra-core/ChakraCore

Assertion failure at lib/Runtime/Language/InlineCache.h:471

Open
#6,191 0 comments 0 reactions 0 assignees View on GitHub
Bug Severity: 2
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

The following code will trigger an assertion failure:

```
function main() {
const v1 = [0x1337,0x1337,0x1337,0x1337,0x1337];

function v10(v11,v12,v13) {
return 1;
}

const v9 = [0x1330, 0x1330, 0x1330];
const v14 = {get:v10};
const v16 = new Proxy(v9,v14);
const v18 = [0x1338];
const v19 = v18.__proto__;

for (let v5 = 0; v5 < 2; v5++) {
const v6 = v1.fround;
v19.__proto__ = v16;
}
console.log(v19.__proto__);
}
main();
```

```
(/home/ChakraCore/lib/Runtime/./Language/InlineCache.h, line 471) *propertyValue == slowPathValue || (VarIs(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal())
Failure: (*propertyValue == slowPathValue || (VarIs(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal()))
```

It seems to fetch from the wrong cache.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.