chakra-core / chakra-core/ChakraCore

Assertion Error in `DeleteProperty`

Open
#6,688 2 comments 0 reactions 0 assignees View on GitHub
Bug Severity: 2
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

PoC:
```javascript
function main() {
do {
delete isNaN.length;
const v4 = Object.getOwnPropertyNames(isNaN);
} while (16 < 1337);
}
main();
// STDERR:
// ASSERTION 12205: (/src/chakracore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 664) !GetIsLocked()
// Failure: (!GetIsLocked())

```

Backtrace:
```
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
frame #0: 0x0000000104548134 libChakraCore.dylib`Js::SimpleTypeHandler<2ul>::DeleteProperty(this=0x0000000102447640, instance=0x0000000102406740, propertyId=206, propertyOperationFlags=PropertyOperation_None) at SimpleTypeHandler.cpp:664:17
661 if (descriptors[index].Attributes & PropertyDeleted)
662 {
663 // A locked type should not have deleted properties
-> 664 Assert(!GetIsLocked());
665 return true;
666 }
667 if (!(descriptors[index].Attributes & PropertyConfigurable))
Target 0: (ch) stopped.
(lldb) bt 20
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
* frame #0: 0x0000000104548134 libChakraCore.dylib`Js::SimpleTypeHandler<2ul>::DeleteProperty(this=0x0000000102447640, instance=0x0000000102406740, propertyId=206, propertyOperationFlags=PropertyOperation_None) at SimpleTypeHandler.cpp:664:17
frame #1: 0x000000010444b884 libChakraCore.dylib`Js::DynamicObject::DeleteProperty(this=0x0000000102406740, propertyId=206, flags=PropertyOperation_None) at DynamicType.cpp:336:34
frame #2: 0x00000001040cc3fe libChakraCore.dylib`Js::JavascriptFunction::DeleteProperty(this=0x0000000102406740, propertyId=206, flags=PropertyOperation_None) at JavascriptFunction.cpp:3055:38
frame #3: 0x0000000103e67188 libChakraCore.dylib`int Js::JavascriptOperators::DeleteProperty_Impl(instance=0x0000000102406740, propertyId=206, propertyOperationFlags=PropertyOperation_None) at JavascriptOperators.cpp:3130:27
frame #4: 0x0000000103e67151 libChakraCore.dylib`Js::JavascriptOperators::DeleteProperty(instance=0x0000000102406740, propertyId=206, propertyOperationFlags=PropertyOperation_None) at JavascriptOperators.cpp:3074:16
frame #5: 0x0000000103e6739d libChakraCore.dylib`Js::JavascriptOperators::OP_DeleteProperty(instance=0x0000000102406740, propertyId=206, scriptContext=0x0000000101017c58, propertyOperationFlags=PropertyOperation_None) at JavascriptOperators.cpp:3149:13
frame #6: 0x0000000103cc5291 libChakraCore.dylib`void Js::InterpreterStackFrame::OP_DeleteFld > __unaligned>(this=0x00007ffeefbfc9e0, playout=0x000000010246006d)0> > __unaligned const __unaligned*) at InterpreterStackFrame.cpp:7674:22
frame #7: 0x0000000103cfda58 libChakraCore.dylib`Js::InterpreterStackFrame::ProcessProfiled(this=0x00007ffeefbfc9e0) at InterpreterHandler.inl:191:3
frame #8: 0x0000000103c938f4 libChakraCore.dylib`Js::InterpreterStackFrame::Process(this=0x00007ffeefbfc9e0) at InterpreterStackFrame.cpp:3472:20
frame #9: 0x0000000103c923fc libChakraCore.dylib`Js::InterpreterStackFrame::InterpreterHelper(function=0x00000001021e6730, args=ArgumentReader @ 0x00007ffeefbfcf10, returnAddress=0x0000000102480f9a, addressOfReturnAddress=0x00007ffeefbfcf58, asmJsReturn=0x0000000000000000) at InterpreterStackFrame.cpp:2153:40
frame #10: 0x0000000103c91480 libChakraCore.dylib`Js::InterpreterStackFrame::InterpreterThunk(layout=0x00007ffeefbfcf70) at InterpreterStackFrame.cpp:1833:16
frame #11: 0x0000000102480f9a
frame #12: 0x000000010440d15e libChakraCore.dylib`amd64_CallFunction at JavascriptFunctionA.S:100
frame #13: 0x00000001040c62db libChakraCore.dylib`void* Js::JavascriptFunction::CallFunction(function=0x00000001021e6730, entryPoint=(libChakraCore.dylib`NativeCodeGenerator::CheckCodeGenThunk(Js::RecyclableObject*, Js::CallInfo, ...)), args=Arguments @ 0x00007ffeefbfd0a0, useLargeArgCount=false)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool) at JavascriptFunction.cpp:1364:16
frame #14: 0x0000000103e2be7f libChakraCore.dylib`void Js::InterpreterStackFrame::OP_CallCommon > > __unaligned>(this=0x00007ffeefbfe270, playout=0x000000010218cdd0, function=0x00000001021e6730, flags=16, spreadIndices=0x0000000000000000)0> > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) at InterpreterStackFrame.cpp:3973:21
frame #15: 0x0000000103e2b971 libChakraCore.dylib`void Js::InterpreterStackFrame::OP_ProfileCallCommon > > __unaligned>(this=0x00007ffeefbfe270, playout=0x000000010218cdd0, function=0x00000001021e6730, flags=0, profileId=0, inlineCacheIndex=0, spreadIndices=0x0000000000000000)0> > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) at InterpreterStackFrame.cpp:4016:9
frame #16: 0x0000000103d04dd8 libChakraCore.dylib`void Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex > >(this=0x00007ffeefbfe270, playout=0x000000010218cdd0)0> > > const __unaligned*) at InterpreterStackFrame.h:520:115
frame #17: 0x0000000103cf98f6 libChakraCore.dylib`Js::InterpreterStackFrame::ProcessProfiled(this=0x00007ffeefbfe270) at InterpreterHandler.inl:91:3
frame #18: 0x0000000103c938f4 libChakraCore.dylib`Js::InterpreterStackFrame::Process(this=0x00007ffeefbfe270) at InterpreterStackFrame.cpp:3472:20
frame #19: 0x0000000103c923fc libChakraCore.dylib`Js::InterpreterStackFrame::InterpreterHelper(function=0x00000001021e66e0, args=ArgumentReader @ 0x00007ffeefbfe760, returnAddress=0x0000000102480fa2, addressOfReturnAddress=0x00007ffeefbfe7a8, asmJsReturn=0x0000000000000000) at InterpreterStackFrame.cpp:2153:40
```

How to reproduce it:
```
- ./build.sh -d -j
- ./ch poc.js
```

Contributor guide

Open the contributing guide

Research direction

Build ChakraCore with ./build.sh -d -j and reproduce the assertion using ./ch poc.js. Start at Js::SimpleTypeHandler::DeleteProperty in lib/Runtime/Types/SimpleTypeHandler.cpp:664, then trace the DeleteProperty call path shown in the backtrace. Done means the PoC no longer triggers the assertion without introducing a regression.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, javascript
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.