chakra-core / chakra-core/ChakraCore

ASSERTION Failure: (!Js::TaggedInt::Is(right)) in ChakraCore/lib/Backend/GlobOpt.cpp

Open
#6,811 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

### commit
41ad58a9eebf8d52a83424c8fccfaacdb14105ec

### Build platform
Ubuntu 20.04

### Build steps

```
./build.sh --debug
```

### poc

```js
function foo() {
var x = new bar();
}

function bar() {
foo();
WebAssembly[0 === 1 ? keys : valueOf];
return {};
}

WScript.Attach(bar);
```

### assert log

```
ASSERTION 2405716: (/media/Store/Project/js-engines/ChakraCore/lib/Backend/GlobOpt.cpp, line 6709) !Js::TaggedInt::Is(right)
Failure: (!Js::TaggedInt::Is(right))
Illegal instruction
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.