chakra-core / chakra-core/ChakraCore
ASSERTION 19984: (/home/yongheng/ChakraCore/lib/Backend/FlowGraph.cpp, line 3959) succ->loop == nullptr || succ->loop->IsDescendentOrSelf(loop)
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
POC:
```javascript
function a() {
for (b = 0; b;)
try {
for (;;)
if (b)
try {
} finally {
continue
}
} finally {
}
}
for (;;)
a()
```
ch version: `ch version 1.12.0.0-beta`, git hash `33db8efd9f02cd528a7305391d7d10765a2e85f3`
In release build, it triggers a segmentation fault.
Stack dump:
```
#0 0x0000555555d88259 in GlobOptBlockData::CloneBlockData(BasicBlock*, BasicBlock*) ()
#1 0x0000555555ec5ec2 in BasicBlock::MergePredBlocksValueMaps(GlobOpt*) ()
#2 0x0000555555d55569 in GlobOpt::OptBlock(BasicBlock*) ()
#3 0x0000555555d56dfa in GlobOpt::OptLoops(Loop*) ()
#4 0x0000555555d5553b in GlobOpt::OptBlock(BasicBlock*) ()
#5 0x0000555555d56dfa in GlobOpt::OptLoops(Loop*) ()
#6 0x0000555555d5553b in GlobOpt::OptBlock(BasicBlock*) ()
#7 0x0000555555d546a1 in GlobOpt::ForwardPass() ()
#8 0x0000555555d53ffc in GlobOpt::Optimize() ()
#9 0x0000555555d4cbef in Func::TryCodegen() ()
#10 0x0000555555d4c913 in Func::Codegen(Memory::JitArenaAllocator*, JITTimeWorkItem*, ThreadContextInfo*, ScriptContextInfo*, JITOutputIDL*, Js::EntryPointInfo*, FunctionJITRuntimeInfo const*, JITTimePolymorphicInlineCacheInfo*, void*, Js::ScriptContextProfiler*, bool) ()
#11 0x0000555555ccb334 in NativeCodeGenerator::CodeGen(Memory::PageAllocatorBase, Memory::PageSegmentBase >*, CodeGenWorkItemIDL*, JITOutputIDL&, bool, Js::EntryPointInfo*) ()
#12 0x0000555555ccb5cd in NativeCodeGenerator::CodeGen(Memory::PageAllocatorBase, Memory::PageSegmentBase >*, CodeGenWorkItem*, bool) ()
#13 0x0000555555ccbe43 in NativeCodeGenerator::Process(JsUtil::Job*, JsUtil::ParallelThreadData*) ()
#14 0x0000555555cdf48e in JsUtil::BackgroundJobProcessor::Process(JsUtil::Job*, JsUtil::ParallelThreadData*) ()
#15 0x0000555555cdf5a5 in JsUtil::BackgroundJobProcessor::Run(JsUtil::ParallelThreadData*) ()
#16 0x0000555555cde4e7 in JsUtil::BackgroundJobProcessor::StaticThreadProc(void*) ()
#17 0x000055555571faa0 in CorUnix::CPalThread::ThreadEntry(void*) ()
#18 0x00007ffff73646db in start_thread (arg=0x7ff7f2d9e700) at pthread_create.c:463
#19 0x00007ffff68d388f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```
Contributor guide
Assessment
This issue has not been assessed yet.