ReportFatalException0

Enviromnet

ubuntu 18

poc

var tests = [{
        name: 'Octal escape sequences are not allowed in string template literals - exhaustive test',
        body: function () {
            function verifyOctalThrows(octalNumber) {
                if (i <= 255) {
                    (function () {
                    }());
                }   
                if (octalNumber < 100) {
                    (function () {
                    }());
                }   
                (function () {
                }());
            }   
            for (var i = 1; i <= 255; i++) {
                verifyOctalThrows(i.toString(8));
            }   
        }   
    }]; 
var JYTH = Promise;
tests.forEach(v => i.toString());

call stack

[#0] 0x555555d59fac → DebugBreak()
[#1] 0x555555d59fac → ReportFatalException(context=<optimized out>, exceptionCode=<optimized out>, reasonCode=<optimized out>, scenario=<optimized out>)
[#2] 0x555555d5a3a7 → OutOfMemory_unrecoverable_error()
[#3] 0x555557ef6673 → Js::Exception::RaiseIfScriptActive(scriptContext=0x0, kind=0x0, returnAddress=0x0)
[#4] 0x555555d5a929 → Js::Throw::OutOfMemory()
[#5] 0x55555754750d → Js::JavascriptString::SafeSzSize(cch=0xfffffd8d)
[#6] 0x55555805f9a1 → Js::BufferStringBuilder::WritableString::New(length=0xfffffd8d, scriptContext=0x61a000000680)
[#7] 0x555556e7e4aa → Js::BufferStringBuilder::BufferStringBuilder(this=0x7fffffffc7f0, charLength=0xfffffd8d, scriptContext=<optimized out>)
[#8] 0x555556e7e4aa → Js::JavascriptExceptionMetadata::PopulateMetadataFromException(metadata=0x7ffff21ad180, recordedException=<optimized out>, scriptContext=<optimized out>)
[#9] 0x555555cfc248 → JsGetAndClearExceptionWithMetadata::$_41::operator()(scriptContext=<optimized out>, _actionEntryPopper=@0x7fffffffca20, this=<optimized out>)

[pleath]

I would treat all fatal errors on legitimate OOM as By Design.

[pleath]

Right. Thanks, @rhuanjl . I’m speaking, not for Microsoft, but from my experience as a member of the team that invented and maintained Chakra. I’m trying to understand @rain6851 ‘s intent in requesting a CVE. 2 points ought to be made, I think:

1. I don’t think this issue requires a CVE.
2. A public forum like GitHub is not an appropriate place for reporting the kind of vulnerability that would require a CVE. The best place I know of for reporting vulnerabilities in Chakra[Core] is [e-mail].