chakra-core/ChakraCore
Voir sur GitHubASSERTION fails in Array.prototype.copyWithin
Open
#6 458 ouverte le 8 juin 2020
Buggood first issue
Métriques du dépôt
- Stars
- (9 000 stars)
- Métriques de merge PR
- (Aucune PR mergée en 30 j)
Description
Hello, I run following code in ch 1.11.19(debug)，and it will crash by an assertion.
let b = [1.1, 2.2, 3.3];
b[4294967294] = 3;
Array.prototype.copyWithin.call(b, 0, 1);
Crash output:
ASSERTION 7690: (/.../ChakraCore-1.11.19/lib/Runtime/Library/JavascriptArray.cpp, line 9309) direction == -1 || (fromVal + count < MaxArrayLength && toVal + count < MaxArrayLength)
Failure: (direction == -1 || (fromVal + count < MaxArrayLength && toVal + count < MaxArrayLength))
Illegal instruction
When reading the source code, I find that the if-condition and the asserts in else-branch are not mutually complemental. https://github.com/microsoft/ChakraCore/blob/c848d4d8d50c0dfb4a23540a9ee6cd023fa029c1/lib/Runtime/Library/JavascriptArray.cpp#L9286 The asserts in else-branch should be : Assert((fromVal + count) <= MaxArrayLength && (toVal + count) <= MaxArrayLength )
ISec Lab 2020.6.8