chakra-core / chakra-core/ChakraCore
ASSERTION Failure: (!Js::TaggedInt::Is(right)) in ChakraCore/lib/Backend/GlobOpt.cpp
Open
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
### commit
41ad58a9eebf8d52a83424c8fccfaacdb14105ec
### Build platform
Ubuntu 20.04
### Build steps
```
./build.sh --debug
```
### poc
```js
function foo() {
var x = new bar();
}
function bar() {
foo();
WebAssembly[0 === 1 ? keys : valueOf];
return {};
}
WScript.Attach(bar);
```
### assert log
```
ASSERTION 2405716: (/media/Store/Project/js-engines/ChakraCore/lib/Backend/GlobOpt.cpp, line 6709) !Js::TaggedInt::Is(right)
Failure: (!Js::TaggedInt::Is(right))
Illegal instruction
```
Contributor guide
Assessment
This issue has not been assessed yet.