chakra-core / chakra-core/ChakraCore
An Assertion triggered by Js::NumberUtilities::IsInSupplementaryPlane() in jitted code
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Hello, running following code in ch 1.11.24(debug), an assertion will be thrown.
```
function opt(start) {
' ' == String.fromCodePoint(start);
}
for(let i = 0; i < 1000; i++)
opt(0);
opt(2147483647);
```
output:
```
ASSERTION 13460: (c:\users\sunlili\documents\workspace\jsenginesfordebug\chakracore-1.11.24\lib\common\common\numberutilities_strtod.cpp, line 2711) codePointValue <= 0x10FFFF
Failure: (codePointValue <= 0x10FFFF)
FATAL ERROR: ch.exe failed due to exception code c0000420
```

`2147483647` is 0x7fffffff, which is an invalid code point value. `String.fromCodePoint()` should throw an Range Error when handling an invalid code point. It seems that the jitted code needs more checks before call `GetStringForCharCodePoint()`.
ISec Lab.
2020.12.16
Contributor guide
Assessment
This issue has not been assessed yet.