chakra-core / chakra-core/ChakraCore

Assertion failure in interpreterstackframe.cpp when handling eval()

Open
#6,517 2 comments 0 reactions 1 assignee Claimed by @rhuanjl View on GitHub
Bug Debugger Severity: 3
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Hello, executing following code in ch 1.11.22(debug), an assertion will be thrown.
```
function opt() {
var eval = WScript.LoadScript('', 'samethread').eval;
eval('function foo() { return {x:1}; }; [...foo()[\'x\']] = [10];');
}

opt();
```
output:
```
ASSERTION 2196: (c:\users\sunlili\documents\workspace\jsenginesfordebug\chakracore-1.11.22\lib\runtime\language\interpreterstackframe.cpp, line 7724) !CrossSite::NeedMarshalVar(value, GetScriptContext())
Failure: (!CrossSite::NeedMarshalVar(value, GetScriptContext()))
FATAL ERROR: ch.exe failed due to exception code c0000420
```
When executing `SetReg(playout->Value2, thisVar)` in line 7746, the value of `thisVar` is undefined.
https://github.com/microsoft/ChakraCore/blob/861a276c346746f3b87347bb094988563d7ee0a7/lib/Runtime/Language/InterpreterStackFrame.cpp#L7738-L7747
`ValidateRegValue(value)` is called in `SetReg()`,
https://github.com/microsoft/ChakraCore/blob/861a276c346746f3b87347bb094988563d7ee0a7/lib/Runtime/Language/InterpreterStackFrame.cpp#L7963-L7969
and assert the `value` does not `NeedMarshal`, but the `NeedMarshalVar()` return true.
https://github.com/microsoft/ChakraCore/blob/861a276c346746f3b87347bb094988563d7ee0a7/lib/Runtime/Language/InterpreterStackFrame.cpp#L7940-L7951

ISec Lab
2020.10.7

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.