Assertion failure in JavascriptArray.cpp

[zhunki]

the following poc cause a assertion failure in "debug" build on ubuntu.

function opt(){
	const v2 = [-1000000000.0];
	v2.length = 4294967295;
	const v3 = v2.copyWithin();
	return v3;
}


for(let i=0;i<0x200;i++){
	opt(false);
}

[ppenzin]

I can see this failing, but want to check out something before I leave this and move to verifying other reports, this would only fail if the length is exactly equal to MaxArrayLength, I feel we might be off-by-one, there is the condition:

        if ((direction == -1 && (fromVal >= MaxArrayLength || toVal >= MaxArrayLength))
            || (((fromVal + count) > MaxArrayLength) || ((toVal + count) > MaxArrayLength)))
        {

https://github.com/chakra-core/ChakraCore/blob/master/lib/Runtime/Library/JavascriptArray.cpp#L9452-L9454

Which doesn't catch MaxArrayLength when direction is 1, but its else branch would trip an assert on just that.

[Arunav1]

Hey @zhunki can I be assigned this work in order to resolve this issue ?

[Zee0227]

function opt() {
const v2 = [-1000000000.0];
// Set a more reasonable length if needed
v2.length = 100; // For example, setting length to 100
const v3 = v2.copyWithin();
return v3;
}

for (let i = 0; i < 0x200; i++) {
opt();
}
Hopefully this works

[ppenzin]

@Arunav1 are you still interested?

[vignesh-j-shetty]

@ppenzin I was looking on to this
I ran

function opt() {
const v2 = [-1000000000.0];
// Set a more reasonable length if needed
v2.length = 100; // For example, setting length to 100
const v3 = v2.copyWithin();
return v3;
}

for (let i = 0; i < 0x200; i++) {
opt();
}

I'm getting this

Is this same or different issue?

[ppenzin]

The bug is an assertion instead of an exception. Exception is desired behavior, it would run out of memory and throw that.

@vignesh-j-shetty, please run code from OP.

[ppenzin]

function opt() { const v2 = [-1000000000.0]; // Set a more reasonable length if needed v2.length = 100; // For example, setting length to 100 const v3 = v2.copyWithin(); return v3; }

for (let i = 0; i < 0x200; i++) { opt(); }

@Zee0227 the bug is in using specific length/access pattern