chakra-core / chakra-core/ChakraCore
ASSERTION failed in GlobOpt::CollectMemOpInfo
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
###### ChakraCore version:
version 1.12.0.0-beta
###### Build Commond
./build.sh --debug
###### OS
Ubuntu 16.04.6 LTS (Linux 4.4.0-142-generic x86_64)
###### Test case
```
function opt(arr, start, end) {
for (let i = start; i < end; i++) {
if (i === 10) {
i += 0;
}
arr[i] = 2.3023e-320;
}
}
let arr = new Array(100);
function main() {
arr.fill(1.1);
for (let i = 0; i < 1000; i += 0)
i++;
opt(arr, 0, 100000);
}
main();
```
###### Output
```
ASSERTION 163874: (ChakraCore/lib/Backend/GlobOpt.cpp, line 2374) !instr->GetDst() || instr->m_opcode == Js::OpCode::IncrLoopBodyCount || !loop->memOpInfo || (instr->m_opcode == Js::OpCode::Ld_I4 && prevInstr && (prevInstr->m_opcode == Js::OpCode::Add_I4 || prevInstr->m_opcode == Js::OpCode::Sub_I4) && instr->GetSrc1()->IsRegOpnd() && instr->GetDst()->IsRegOpnd() && prevInstr->GetDst()->IsRegOpnd() && instr->GetDst()->GetStackSym() == prevInstr->GetSrc1()->GetStackSym() && instr->GetSrc1()->GetStackSym() == prevInstr->GetDst()->GetStackSym()) || !loop->memOpInfo->inductionVariableChangeInfoMap->ContainsKey(GetVarSymID(instr->GetDst()->GetStackSym()))
Failure: (!instr->GetDst() || instr->m_opcode == Js::OpCode::IncrLoopBodyCount || !loop->memOpInfo || (instr->m_opcode == Js::OpCode::Ld_I4 && prevInstr && (prevInstr->m_opcode == Js::OpCode::Add_I4 || prevInstr->m_opcode == Js::OpCode::Sub_I4) && instr->GetSrc1()->IsRegOpnd() && instr->GetDst()->IsRegOpnd() && prevInstr->GetDst()->IsRegOpnd() && instr->GetDst()->GetStackSym() == prevInstr->GetSrc1()->GetStackSym() && instr->GetSrc1()->GetStackSym() == prevInstr->GetDst()->GetStackSym()) || !loop->memOpInfo->inductionVariableChangeInfoMap->ContainsKey(GetVarSymID(instr->GetDst()->GetStackSym())))
Illegal instruction
```
Credits: This vulnerability is detected by chong from OWL337.
Contributor guide
Assessment
This issue has not been assessed yet.