search

chakra-core / ChakraCore

ChakraCore is an open source Javascript engine with a C API.
MIT License
9.11k stars 1.2k forks source link

ASSERTION in ChakraCore/lib/Jsrt/Jsrt.cpp #6716

Open anbu1024 opened 3 years ago

anbu1024 commented 3 years ago

chakra version

Checked revision: 0fc6103461dac83f24e418b7013af5b4137607f5
Build command: ./build.sh --debug
$ chakra --version
ch version 1.12.0.0-beta

os

Ubuntu 20.04.2 LTS

testcase

var x = WScript.LoadScript('', 'samethread', 'foo.js');

const y = x('test', Function);

The error message:

ASSERTION 869987: (ChakraCore/lib/Jsrt/Jsrt.cpp, line 1543) *value == nullptr || !Js::CrossSite::NeedMarshalVar(*value, scriptContext)
 Failure: (*value == nullptr || !Js::CrossSite::NeedMarshalVar(*value, scriptContext))
Illegal instruction (core dumped)

Backtrace:

#0  0x00007ffff3d5a12f in JsGetPropertyCommon (scriptContext=0x555555fb3ab8, object=0x7ff7f1379840, propertyRecord=0x7ffff5a498f0 <Js::BuiltInPropertyRecords::exception>, value=0x7fffffffd490) at ChakraCore/lib/Jsrt/Jsrt.cpp:1543
#1  0x00007ffff3d59fad in JsGetProperty::$_37::operator() (this=0x7fffffffcbe0, scriptContext=0x555555fb3ab8, _actionEntryPopper=...) at ChakraCore/lib/Jsrt/Jsrt.cpp:1560
#2  0x00007ffff3d59dd4 in ContextAPIWrapper<false, JsGetProperty::$_37>(JsGetProperty::$_37)::{lambda(Js::ScriptContext*)#1}::operator()(Js::ScriptContext*) const (this=0x7fffffffcb78, scriptContext=0x555555fb3ab8) at ChakraCore/lib/Jsrt/JsrtInternal.h:237
#3  0x00007ffff3d59774 in ContextAPIWrapper_Core<false, ContextAPIWrapper<false, JsGetProperty::$_37>(JsGetProperty::$_37)::{lambda(Js::ScriptContext*)#1}>(ContextAPIWrapper<false, JsGetProperty::$_37>(JsGetProperty::$_37)::{lambda(Js::ScriptContext*)#1}) (fn=...) at ChakraCore/lib/Jsrt/JsrtInternal.h:192
#4  0x00007ffff3d3f066 in ContextAPIWrapper<false, JsGetProperty::$_37> (fn=...) at ChakraCore/lib/Jsrt/JsrtInternal.h:235
#5  0x00007ffff3d3f01e in JsGetProperty (object=0x7ff7f1379840, propertyId=0x7ffff5a498f0 <Js::BuiltInPropertyRecords::exception>, value=0x7fffffffd490) at ChakraCore/lib/Jsrt/Jsrt.cpp:1550
#6  0x0000555555565e70 in ChakraRTInterface::JsGetProperty (object=0x7ff7f1379840, property=0x7ffff5a498f0 <Js::BuiltInPropertyRecords::exception>, value=0x7fffffffd490) at ChakraCore/bin/ch/ChakraRtInterface.h:414
#7  0x000055555557093c in WScriptJsrt::PrintException (fileName=0x555555f80540 "02.js", jsErrorCode=JsErrorScriptException, exception=0x7ff7f137d040) at ChakraCore/bin/ch/WScriptJsrt.cpp:1799
#8  0x000055555555d880 in RunScript (fileName=0x555555f80540 "02.js", fileContents=0x555555f81660 "\nif (typeof load == 'undefined')\n    load = function (js_path) {\n        WScript.LoadScriptFile(js_path);\n    };\n\nvar x = WScript.LoadScript('', 'samethread', 'foo.js');\n\nconst y = x('test', Function);\n\n", fileLength=0xcb, fileContentsFinalizeCallback=0x55555556abe0 <WScriptJsrt::FinalizeFree(void*)>, bufferValue=0x0, fullPath=0x7fffffffd7d0 "02.js", parserStateCache=0x0) at ChakraCore/bin/ch/ch.cpp:472
#9  0x000055555555f2f0 in ExecuteTest (fileName=0x555555f80540 "02.js") at ChakraCore/bin/ch/ch.cpp:917
#10 0x000055555555f3ac in ExecuteTestWithMemoryCheck (fileName=0x555555f80540 "02.js") at ChakraCore/bin/ch/ch.cpp:967
#11 0x000055555555fc77 in main (argc=0x2, c_argv=0x7fffffffdc18) at ChakraCore/bin/ch/ch.cpp:1274
#12 0x00007ffff75870b3 in __libc_start_main (main=0x55555555f410 <main(int, char**)>, argc=0x2, argv=0x7fffffffdc18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdc08) at ../csu/libc-start.c:308
#13 0x000055555555ca7e in _start ()
rhuanjl commented 3 years ago

A bug with attempting to move values between contexts - may be to do with specific reserved names.