Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed in ecma-helpers-value(ecma_check_value_type_is_spec_defined)

[hope-fly]

JerryScript revision

Commit: 51da1551

Version: v3.0.0

Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)

Build steps

./tools/build.py --clean --debug --profile=es2015-subset --compile-flag=-fsanitize=address --compile-flag=-m32 --lto=off --logging=on --line-info=on --error-message=on --system-allocator=on --stack-limit=20

Test case

function JSEtest(f, iters = 1000) {
  for (let i = 0; i < iters; i++) {
    f();
  }
}

function throwTDZ(f) {
  let threw = false;
  try {
    f();
  } catch (e) {
    ;
  }
}

JSEtest(function () {
  class M {
    get foo() {
      return this._x;
    }
    set foo(x) {
      this._x = x;
    }
  }

  function fooProp() {
    return 'foo';
  }

  class T1 extends M {
    constructor() {
      super.foo = 20;
    }
  }

  class T2 extends M {
    constructor() {
      super[fooProp()] = 20;
    }
  }

  class T3 extends M {
    constructor() {
      super[fooProp()];
    }
  }

  class T4 extends M {
    constructor() {
      super.foo;
    }
  }

  class T5 extends M {
    constructor() {
      (() => super.foo = 20)();
    }
  }

  class T6 extends M {
    constructor() {
      (() => super[fooProp()] = 20)();
    }
  }

  class T7 extends M {
    constructor() {
      (() => super[fooProp()])();
    }
  }

  class T8 extends M {
    constructor() {
      (() => super.foo)();
    }
  }

  throwTDZ(function () {
    new T1();
  });
  throwTDZ(function () {
    new T2();
  });
  throwTDZ(function () {
    new T3();
  });
  throwTDZ(function () {
    new T4();
  });
  throwTDZ(function () {
    new T5();
  });
  throwTDZ(function () {
    new T6();
  });
  throwTDZ(function () {
    new T7();
  });
  throwTDZ(function () {
    new T8();
  });
});

​

Execution steps & Output

$ ./jerryscript/build/bin/jerry poc.js

ICE: Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed at /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_check_value_type_is_spec_defined):441.
Error: ERR_FAILED_INTERNAL_ASSERTION

Credits: Found by OWL337 team.