chakra-core / chakra-core/ChakraCore

ASSERTION failure in ChakraCore/lib/Runtime/Language/CacheOperator.inl, line 367

Open
#6,268 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

The debug build of Chakacore crashes.
PoC:
```
class X {
constructor() {
Object.defineProperty(this, "prop1", {
configurable: true,
writable: false,
value: 1
});
}
f1() {
super.prop1 = 2;
}
}
var x = new X();
(() => x.f1())();
print(x.prop1) // It should be 1; but print 2
print(Object.getOwnPropertyDescriptor(x, 'prop1').writable)
```
This PoC leads to be able to write read-only property 'prop1'.
Version=v1.11.12
OS=Ubuntu 16.04.6
Arch=x86_64

Contributor guide

Open the contributing guide

Research direction

Start in ChakraCore/lib/Runtime/Language/CacheOperator.inl around line 367 and reproduce the debug-build assertion with the JavaScript PoC on the reported version and platform. Trace the handling of the super property assignment and verify that a non-writable prop1 remains unchanged and that the assertion no longer occurs. There is no test path named in the issue, so locate the relevant runtime regression-test area before adding coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, javascript
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.