search

cesanta / mjs

Embedded JavaScript engine for C/C++
https://mongoose-os.com
Other
1.91k stars 176 forks source link

Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed src/mjs_gc.c:354: gc_mark_string. #185

Open hope-fly opened 2 years ago

hope-fly commented 2 years ago
mJS revision

Commit: b1b6eac

Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)

Build steps
vim Makefile
DOCKER_GCC=gcc
DOCKER_CLANG=clang
$(DOCKER_GCC) $(CFLAGS) $(TOP_MJS_SOURCES) $(TOP_COMMON_SOURCES) -o $(PROG)
# save the makefile then make
make
Test case
poc.js 


```javascript
(function () {
  ((function f(a) {
    if (a > 0) {
      if (gc(JSON.stringify({
        translate: ({
          enumerable: [
            !Object.create
          ]
        })
      })) !== f("switch(''){default:break;/*DUPTRY525*/}")('#1.1: -0 - -0 === 0. Actual: ' !== f(a - 1))) {
        f(a - 1)
      }
    }
  })(6))
})()
```
Execution steps & Output
$ ./mjs/build/mjs poc.js
mjs: src/mjs_gc.c:354: gc_mark_string: Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed.
[1]    68013 abort      mjs poc.js

Credits: Found by OWL337 team.