chakra-core / ChakraCore

ChakraCore is an open source Javascript engine with a C API.
MIT License
9.06k stars 1.19k forks source link

Derived class need to define marshal to script context Failure: (VirtualTableInfo<ScriptFunction>::HasVirtualTable(this)) #6961

Open anbu1024 opened 7 months ago

anbu1024 commented 7 months ago

ChakraCore version: commit c3ead3f

Build cmd:

./build.sh --debug --static

Test case:

function test() {
    async function foo(a1,a2) {
        for (let i = a2; i < foo; i = i + 3705358555) {
            const ret = await a1;
        }

        async function bar() {
        }

        const p = new Proxy(Reflect,bar);
        p.__proto__ = bar;
    }

    foo();
    new Float32Array(Float32Array);

    function baz(v21,v22) {
        let {"constructor":v23,"ignoreCase":v24,"length":v25,} = v21;
    }
    const r = baz(foo,foo);
    return r;
}

for(let i=0;i<0x200;i++)
{
    test();
}

Execute

./ch ./test.js

Error msg:

ASSERTION 2779735: (ChakraCore/lib/Runtime/./Library/ScriptFunction.h, line 78) Derived class need to define marshal to script context
 Failure: (VirtualTableInfo<ScriptFunction>::HasVirtualTable(this))
Illegal instruction