facebook / hermes

A JavaScript engine optimized for running React Native.
https://hermesengine.dev/
MIT License
9.71k stars 622 forks source link

Assertion `!opFlags.getMustExist() && "MustExist cannot be used with Proxy objects"' failed #379

Open WilliamParks opened 3 years ago

WilliamParks commented 3 years ago

Bug Description

Hermes version: 7d4cb023f9cfc87d2b0e8144ccad3bd329269af8 React Native version (if any): Android version (if any): Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64):

Steps To Reproduce

The provided code produces the following assertion failure in Hermes. I do not believe this is security issue.

Assertion: hermes: ../lib/VM/JSObject.cpp:1378: static CallResult<bool> hermes::vm::JSObject::putNamedWithReceiver_RJS(Handle<hermes::vm::JSObject>, hermes::vm::Runtime *, hermes::vm::SymbolID, Handle<>, Handle<>, hermes::vm::PropOpFlags): Assertion `!opFlags.getMustExist() && "MustExist cannot be used with Proxy objects"' failed.

code example:

var v4 = new Proxy({},{});
this.__proto__ = v4;
var v35 = "'use strict'; result = 0;"
eval(v35);

The Expected Behavior

No assertion failure.

tmikov commented 1 year ago

This bug still exists.