chakra-core / chakra-core/ChakraCore

An Assertion triggered by Js::NumberUtilities::IsInSupplementaryPlane() in jitted code

Open
#6,538 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Hello, running following code in ch 1.11.24(debug), an assertion will be thrown.
```
function opt(start) {
' ' == String.fromCodePoint(start);
}
for(let i = 0; i < 1000; i++)
opt(0);

opt(2147483647);
```
output:
```
ASSERTION 13460: (c:\users\sunlili\documents\workspace\jsenginesfordebug\chakracore-1.11.24\lib\common\common\numberutilities_strtod.cpp, line 2711) codePointValue <= 0x10FFFF
Failure: (codePointValue <= 0x10FFFF)
FATAL ERROR: ch.exe failed due to exception code c0000420
```
tmp

`2147483647` is 0x7fffffff, which is an invalid code point value. `String.fromCodePoint()` should throw an Range Error when handling an invalid code point. It seems that the jitted code needs more checks before call `GetStringForCharCodePoint()`.

ISec Lab.
2020.12.16

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.