chakra-core / chakra-core/ChakraCore
ASSERTION failure in ChakraCore/lib/Runtime/Language/CacheOperator.inl, line 367
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
The debug build of Chakacore crashes.
PoC:
```
class X {
constructor() {
Object.defineProperty(this, "prop1", {
configurable: true,
writable: false,
value: 1
});
}
f1() {
super.prop1 = 2;
}
}
var x = new X();
(() => x.f1())();
print(x.prop1) // It should be 1; but print 2
print(Object.getOwnPropertyDescriptor(x, 'prop1').writable)
```
This PoC leads to be able to write read-only property 'prop1'.
Version=v1.11.12
OS=Ubuntu 16.04.6
Arch=x86_64
Contributor guide
Research direction
Start in ChakraCore/lib/Runtime/Language/CacheOperator.inl around line 367 and reproduce the debug-build assertion with the JavaScript PoC on the reported version and platform. Trace the handling of the super property assignment and verify that a non-writable prop1 remains unchanged and that the assertion no longer occurs. There is no test path named in the issue, so locate the relevant runtime regression-test area before adding coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, javascript
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100