Assertion Failure : buffer[length] == k_dbgFill in ChakraCore/lib/Runtime/Library/BufferStringBuilder.cpp, line 70

Version
---
Branch : master
Version : https://github.com/chakra-core/ChakraCore/commit/c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

Platform
---
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

Build
---
- Address Sanitizer=On
- Debug
```
./build.sh -d --static --sanitize=address
```

PoC
---
testcase

```javascript
32 ; import ( ( { a = { b } = { b : 32 } } ) => ( a . a . b . b ) . b = import ( { } ) ) ; 32 ; a ; b ;
```

```javascript
// poc.js
import ( ( ) => ( a ) . b = import ( { } ) ) ;
```

Execution steps & Output
---

```
$ ./ch poc.js
ASSERTION 583600: (./ChakraCore/lib/Runtime/Library/BufferStringBuilder.cpp, line 70) BufferString sentinel was overwritten.
Failure: (buffer[length] == k_dbgFill)
Illegal instruction
```

Backtrace
---
```
(gdb) bt
#0 0x000055555ad6fb9c in Js::BufferStringBuilder::ToString (this=0x7fffffffb950) at ./ChakraCore/lib/Runtime/Library/BufferStringBuilder.cpp:70
#1 0x00005555595527f6 in Js::ScriptFunction::EnsureSourceString (this=) at ./ChakraCore/lib/Runtime/Library/ScriptFunction.cpp:419
#2 0x0000555558c1c2f1 in Js::JavascriptFunction::EntryToString (function=, callInfo=...) at ./ChakraCore/lib/Runtime/Library/JavascriptFunction.cpp:1596
#3 0x0000555559819d01 in Js::DynamicObject::CallToPrimitiveFunction(void*, int, void**, Js::ScriptContext*)::$_0::operator()() const (this=)
at ./ChakraCore/lib/Runtime/Types/DynamicType.cpp:464
#4 0x0000555559816de9 in ThreadContext::ExecuteImplicitCall(Js::RecyclableObject*, Js::ImplicitCallFlags, Js::DynamicObject::CallToPrimitiveFunction(void*, int, void**, Js::ScriptContext*)::$_0) (this=0x623000000158, function=0x7ffff28428c0, flags=Js::ImplicitCall_ToPrimitive, implicitCall=...)
at ./ChakraCore/lib/Runtime/./Base/ThreadContext.h:1593
#5 Js::DynamicObject::CallToPrimitiveFunction (this=, toPrimitiveFunction=, propertyId=, result=, requestContext=)
at ./ChakraCore/lib/Runtime/Types/DynamicType.cpp:460
#6 0x000055555981ac10 in Js::DynamicObject::ToPrimitiveImpl<376> (this=, result=0x7fffffffbe40, requestContext=)
at ./ChakraCore/lib/Runtime/Types/DynamicType.cpp:451
#7 0x0000555559816609 in Js::DynamicObject::ToPrimitive (this=0x7ffff28a6730, hint=Js::JavascriptHint::HintString, result=0x7fffffffbe40, requestContext=0x622000000158)
at ./ChakraCore/lib/Runtime/Types/DynamicType.cpp:391
#8 0x00005555584828a3 in Js::JavascriptConversion::OrdinaryToPrimitive<(Js::JavascriptHint)1> (value=0x7ffff28a6730, requestContext=)
at ./ChakraCore/lib/Runtime/Language/JavascriptConversion.cpp:533
#9 0x000055555848ad8a in Js::JavascriptConversion::MethodCallToPrimitive<(Js::JavascriptHint)1> (value=0x7ffff28a6730, requestContext=)
at ./ChakraCore/lib/Runtime/Language/JavascriptConversion.cpp:469
#10 0x00005555584748ae in Js::JavascriptConversion::ToPrimitive<(Js::JavascriptHint)1> (aValue=0x7ffff28a6730, requestContext=0x622000000158)
at ./ChakraCore/lib/Runtime/Language/JavascriptConversion.cpp:417
#11 0x000055555845be57 in Js::JavascriptConversion::ToString (aValue=0x7ffff28a6730, scriptContext=0x622000000158) at ./ChakraCore/lib/Runtime/Language/JavascriptConversion.cpp:668
#12 0x000055555859afa5 in Js::JavascriptOperators::OP_ImportCall (function=, specifier=, scriptContext=)
at ./ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:10250
#13 0x0000555557d09648 in Js::InterpreterStackFrame::OP_ImportCall (this=0x7fffffffca60, specifier=0x7ffff28a6730, scriptContext=0x622000000158)
at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:7917
#14 Js::InterpreterStackFrame::ProcessProfiledExtendedOpcodePrefix (this=, ip=0x7ffff28ee23a "$") at ./ChakraCore/lib/Runtime/Language/InterpreterHandler.inl:324
#15 0x0000555557e0ce89 in Js::InterpreterStackFrame::ProcessProfiled (this=) at ./ChakraCore/lib/Runtime/Language/InterpreterLoop.inl:357
#16 0x0000555557c426df in Js::InterpreterStackFrame::Process (this=0x7fffffffca60) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3472
#17 0x0000555557c3d150 in Js::InterpreterStackFrame::InterpreterHelper (function=, args=, returnAddress=,
addressOfReturnAddress=, asmJsReturn=) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:2153
#18 0x0000555557c3a80d in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7ffff26c0fa2) at ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:1833
#19 0x00007ffff26c0fa2 in ?? ()
#20 0x00007fffffffcff0 in ?? ()
#21 0x0000555559723c4e in amd64_CallFunction () at ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
Backtrace stopped: frame did not save the PC
(gdb)
```

Credits: @Ye0nny, @EJueon of the seclab-yonsei.