Binpang

Assertion Error in `BeginDumpObject`

1

PoC: ```javascript function main() { const v0 = parseInt; const v2 = [13.37,13.37,13.37,13.37]; const v4 = [1337,1337,1337]; const v5 = [1337]; const v6 = {__proto__:1337,c:v4,constructor:v5,d:v4,e:v2}; const v10 = [13.37,13.37,13.37,13.37,13.37]; const...

Invalid Memory Access in `GetScriptContext`

1

PoC: ```javascript function main() { const v0 = {}; async function v1(v2,v3,v4,v5,v6) { for (const v7 in v0) { let v8 = 0; const v9 = v8++; const v10 =...

Assertion Failure in `FuncInfo::FindOrAddRootObjectInlineCacheId`

1

PoC: ```javascript function main() { try { } catch(v1) { if (isConcatSpreadable) { } else { } } const v2 = ` let v3 = 0; while (v3 < 10)...

Invalid memory access in `GetEntryPoint`

2

PoC: ```javascript function main() { const v0 = {}; async function v1(v2,v3,v4,v5,v6) { function v7(v8) { } const v9 = v7; for (const v10 in v0) { const v12 =...

Throw a `FatalJsReentrancyError`

1

PoC: ``` function main() { function v0(v1,v2) { const v7 = new Int16Array(44915); for (let v10 = 0; v10 < 1337; v10++) { v7[v10] = 1337; v7[v10] = v2; }...

PoC: ```javascript function main() { const v2 = {constructor:"ffsJvcB1uX"}; for (let v5 = 1; v5 < 6; v5 = v5 + -2) { const v8 = Function(); v8.__proto__ = v2;...

PoC: ```javascript function main() { const v3 = async (v4,v5,v6,v7) => { }; const v10 = [13.37]; const v11 = {__proto__:v10,e:"e",valueOf:v3}; for (let v14 = v11; v14 < 1337; v14...

PoC: ```javascript function main() { const v0 = {}; async function v1(v2,v3,v4,v5,v6) { const v7 = ` Object; `; for (let v9 in v0) { const v10 = v9++; const...

AssertOrFailFast in `MapStFldHelper`

1

PoC: ```javascript function main() { do { function v2(v3,v4,v5,v6,v7) { const v15 = [13.37,13.37,13.37,13.37]; const v16 = v15[13.37]; const v17 = eval(1,..."ignoreCase",v16,..."pS1LFZI9uc",1); } const v19 = [13.37,13.37,13.37,13.37,13.37]; const v20 =...

Assertion Error in `DeleteProperty`

2

PoC: ```javascript function main() { do { delete isNaN.length; const v4 = Object.getOwnPropertyNames(isNaN); } while (16 < 1337); } main(); // STDERR: // ASSERTION 12205: (/src/chakracore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 664) !GetIsLocked() //...