tjuTangSong

SEGV on unknown address 0x000000000000

1

Branch: `master` Commit: `cbb9b101d18e4c1682ca39a52a201d8e4241ea17` POC is: ``` let xxx = new Uint32Array(0x10000); xxx.slice = Array.prototype.slice; function jit(arr, index){ let ut = arr.slice(0,0); //become definite Uint32Array but |arr| is a VirtualUint32Array...

SEGV (/root/ChakraCore-latest/out/Release/ch+0x6e3fff) in Js::EntryPointInfo::HasInlinees()

2

Branch: `master` Commit: `cbb9b101d18e4c1682ca39a52a201d8e4241ea17` POC is: ``` async function f1() { await null; throw WScript.f2a(f1()); } f1(); async function f2() { async function f2a() { throw "err"; } async function...

Branch: `master` Commit : `cbb9b101d18e4c1682ca39a52a201d8e4241ea17` POC : ``` function Run() { var intl = new Intl.Collator(); intl.compare('a','b');/**bp:resume('step_into');locals()**/ let C1 = class NotC1 { attemptOuterBindingChange() { C1 = 1; } attemptInnerBindingChange()...

SEGV (/root/ChakraCore-latest/out/Release/ch+0x8bcaaf) in Js::DiagScopeVariablesWalker::GetChildrenCount()

1

Branch: `master` Commit: `cbb9b101d18e4c1682ca39a52a201d8e4241ea17` POC: ``` function Run() { function f1() { var m = 31; m++; var coll = new Intl.Collator(); m += f2(); return m; } function f2()...

SEGV (/root/ChakraCore-latest/out/Release/ch+0xe248a5) in Js::ProfilingHelpers::ProfiledNewScArray(unsigned int, Js::FunctionBody*, unsigned short)

1

Branch: `master` Commit: `cbb9b101d18e4c1682ca39a52a201d8e4241ea17` POC is: ``` function attach(f) { (function (r) { WScript.Attach(r); })(f); } async function mainTest(notAttachCall) { if (notAttachCall) { for (let i = 0; i <...