Closed bin2415 closed 3 years ago
FYI, this issue isn't reproducable on windows 10 in interpreted and dynapogo modes.
It is reproducable on Ubuntu 18.04 and Mac OS 11.2 when built with debug version.
This is due to Js::JavascriptOperators::OP_CloneScopeSlots
getting slotArray == nullptr
.
I can reproduce the bug in Ubuntu 18 (WSL). However CollectGarbage
(both the call and engine switch) is not needed, also the reproducer can be reduced to this:
function main() {
async function v0(v2) {
for (let v8 = 0; v8 < 1337; v8++) {
const v9 = class V9 {
constructor(v11,v12,v13) {
const v14 = !v8;
}
};
const v24 = await v2;
}
}
const v25 = v0();
}
main();
Command would then become ./ch poc.js
.
This is a new bug from jitting generators, will need to fix this or re-disable generator jit :( before release.
I think it's to do with the handling of OpCode::CloneInnerScopeSlots in IRBuilder.cpp - hopefully will be able to write a fix this weekend.
Reduced further:
async function v0() {
for (let v8 = 0; v8 < 1337; v8++) {
function foo () {v8}
await undefined;
}
}
v0();
The problem is v8
not being restored properly after await
- only happens if v8 is declared with let
AND referenced in a different inner scope (hence the function def - I swapped out the class definition to simplify)
I'm working on a fix.
PoC:
backtrace:
How to reproduce:
The error code: