chakra-core / chakra-core/ChakraCore

Assertion Error in `EncoderMD::GetMod`

Open
#6,693 0 comments 0 reactions 0 assignees View on GitHub
Bug Severity: 2
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

PoC:
```javascript
function main() {
const v0 = {};
async function v1(v2,v3,v4,v5,v6) {
const v7 = `
Object;
`;
for (let v9 in v0) {
const v10 = v9++;
const v12 = 1337 - v7;
const v13 = await v10;
}
const v14 = v1();
}
const v15 = v1();
}
main();

```

Backtrace:
```
* thread #6, stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
frame #0: 0x0000000102654240 libChakraCore.dylib`EncoderMD::GetMod(this=0x000070000904b158, symOpnd=0x00000009092952b0, pDispSize=0x0000700009049a48, rmReg=0x0000700009049a21) at EncoderMD.cpp:263:9
260 }
261 else
262 {
-> 263 Assert(offset != 0);
264 }
265 return GetMod((size_t)offset + (size_t)symOpnd->m_offset, rmReg == RegRBP, pDispSize);
266
Target 0: (ch) stopped.
(lldb) bt
* thread #6, stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
* frame #0: 0x0000000102654240 libChakraCore.dylib`EncoderMD::GetMod(this=0x000070000904b158, symOpnd=0x00000009092952b0, pDispSize=0x0000700009049a48, rmReg=0x0000700009049a21) at EncoderMD.cpp:263:9
frame #1: 0x0000000102654500 libChakraCore.dylib`EncoderMD::EmitModRM(this=0x000070000904b158, instr=0x0000000909295350, opnd=0x00000009092952b0, reg1='\b') at EncoderMD.cpp:345:21
frame #2: 0x0000000102656b5f libChakraCore.dylib`EncoderMD::Encode(this=0x000070000904b158, instr=0x0000000909295350, pc=", beginCodeAddress="H�@�\x01") at EncoderMD.cpp:898:37
frame #3: 0x000000010222a448 libChakraCore.dylib`Encoder::Encode(this=0x000070000904b150) at Encoder.cpp:223:33
frame #4: 0x000000010226d092 libChakraCore.dylib`Func::TryCodegen(this=0x000070000904c150) at Func.cpp:561:17
frame #5: 0x000000010226bfef libChakraCore.dylib`Func::Codegen(alloc=0x000070000904c6e0, workItem=0x0000000909241030, threadContextInfo=0x000000010180e858, scriptContextInfo=0x000000090800ee58, outputData=0x000070000904cb20, epInfo=0x000000090912d1b0, runtimeInfo=0x0000000000000000, polymorphicInlineCacheInfo=0x00000009091d2a40, codeGenAllocators=0x0000000908809658, codeGenProfiler=0x0000000000000000, isBackgroundJIT=true) at Func.cpp:325:18
frame #6: 0x00000001025bd931 libChakraCore.dylib`NativeCodeGenerator::CodeGen(this=0x0000000100605328, pageAllocator=0x00000009077040f8, workItemData=0x00000009093045c0, jitWriteData=0x000070000904cb20, foreground=false, epInfo=0x000000090912d1b0) at NativeCodeGenerator.cpp:890:9
frame #7: 0x00000001025c00b8 libChakraCore.dylib`NativeCodeGenerator::CodeGen(this=0x0000000100605328, pageAllocator=0x00000009077040f8, workItem=0x0000000909304598, foreground=false) at NativeCodeGenerator.cpp:1007:5
frame #8: 0x00000001025c37f4 libChakraCore.dylib`NativeCodeGenerator::Process(this=0x0000000100605328, job=0x00000009093045a0, threadData=0x00000009077040d8) at NativeCodeGenerator.cpp:1907:13
frame #9: 0x0000000102678541 libChakraCore.dylib`JsUtil::BackgroundJobProcessor::Process(this=0x0000000100605498, job=0x00000009093045a0, threadData=0x00000009077040d8) at Jobs.cpp:1037:36
frame #10: 0x0000000102678b26 libChakraCore.dylib`JsUtil::BackgroundJobProcessor::Run(this=0x0000000100605498, threadData=0x00000009077040d8) at Jobs.cpp:1135:44
frame #11: 0x0000000102676062 libChakraCore.dylib`JsUtil::BackgroundJobProcessor::StaticThreadProc(lpParam=0x00000009077040d8) at Jobs.cpp:1319:20
frame #12: 0x000000010209da83 libChakraCore.dylib`CorUnix::CPalThread::ThreadEntry(pvParam=0x0000000908808200) at pal_thread.cpp:1605:16
frame #13: 0x00007fff20330950 libsystem_pthread.dylib`_pthread_start + 224
frame #14: 0x00007fff2032c47b libsystem_pthread.dylib`thread_start + 15
```

How to reproduce it:
```
- ./build.sh -d -j
- ch poc.js
```

Contributor guide

Open the contributing guide

Research direction

Start with EncoderMD.cpp at the GetMod assertion on line 263, then follow the EmitModRM and Encode frames named in the backtrace. Build ChakraCore with ./build.sh -d -j and run ch poc.js to reproduce the failure. Done means the provided PoC no longer triggers the assertion while preserving normal execution.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, javascript
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.