chakra-core / chakra-core/ChakraCore

ASSERTION failed in GlobOpt::CollectMemOpInfo

Open
#6,455 1 comment 0 reactions 0 assignees View on GitHub
Bug
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

###### ChakraCore version:
version 1.12.0.0-beta

###### Build Commond
./build.sh --debug

###### OS
Ubuntu 16.04.6 LTS (Linux 4.4.0-142-generic x86_64)

###### Test case
```
function opt(arr, start, end) {
for (let i = start; i < end; i++) {
if (i === 10) {
i += 0;
}
arr[i] = 2.3023e-320;
}
}

let arr = new Array(100);

function main() {
arr.fill(1.1);

for (let i = 0; i < 1000; i += 0)
i++;

opt(arr, 0, 100000);
}

main();

```
###### Output
```
ASSERTION 163874: (ChakraCore/lib/Backend/GlobOpt.cpp, line 2374) !instr->GetDst() || instr->m_opcode == Js::OpCode::IncrLoopBodyCount || !loop->memOpInfo || (instr->m_opcode == Js::OpCode::Ld_I4 && prevInstr && (prevInstr->m_opcode == Js::OpCode::Add_I4 || prevInstr->m_opcode == Js::OpCode::Sub_I4) && instr->GetSrc1()->IsRegOpnd() && instr->GetDst()->IsRegOpnd() && prevInstr->GetDst()->IsRegOpnd() && instr->GetDst()->GetStackSym() == prevInstr->GetSrc1()->GetStackSym() && instr->GetSrc1()->GetStackSym() == prevInstr->GetDst()->GetStackSym()) || !loop->memOpInfo->inductionVariableChangeInfoMap->ContainsKey(GetVarSymID(instr->GetDst()->GetStackSym()))
Failure: (!instr->GetDst() || instr->m_opcode == Js::OpCode::IncrLoopBodyCount || !loop->memOpInfo || (instr->m_opcode == Js::OpCode::Ld_I4 && prevInstr && (prevInstr->m_opcode == Js::OpCode::Add_I4 || prevInstr->m_opcode == Js::OpCode::Sub_I4) && instr->GetSrc1()->IsRegOpnd() && instr->GetDst()->IsRegOpnd() && prevInstr->GetDst()->IsRegOpnd() && instr->GetDst()->GetStackSym() == prevInstr->GetSrc1()->GetStackSym() && instr->GetSrc1()->GetStackSym() == prevInstr->GetDst()->GetStackSym()) || !loop->memOpInfo->inductionVariableChangeInfoMap->ContainsKey(GetVarSymID(instr->GetDst()->GetStackSym())))
Illegal instruction
```
Credits: This vulnerability is detected by chong from OWL337.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.