Assertion 'array_index_name_pos < array_index_named_properties_count'

[nszetei]

JerryScript revision

6cd309b

Build platform

Ubuntu 20.04 LTS (Linux 5.4.0-31-generic x86_64)

Build steps

python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g --error-messages=on --debug --compile-flag=-g --strip=off --logging=on --compile-flag=-fsanitize=address

Test case

var v1 = typeof 13.37;
var v3 = Object(v1);
var v5 = [13.37,13.37];
var v6 = [v5];
v3.__proto__ = v6;
for (var v7 in v3) {}

Output

$ ICE: Assertion 'array_index_name_pos < array_index_named_properties_count' failed at /home/jerryscript/jerry-core/ecma/operations/ecma-objects.c(ecma_op_object_get_property_names):2410.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted (core dumped)

Backtrace

(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff73a0859 in __GI_abort () at abort.c:79
#2  0x00005555556e7435 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at /home/jerryscript/jerry-port/default/default-fatal.c:30
#3  0x00005555556297e5 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at /home/jerryscript/jerry-core/jrt/jrt-fatals.c:63
#4  0x0000555555629840 in jerry_assert_fail (assertion=0x555555710da0 "array_index_name_pos < array_index_named_properties_count",
    file=0x555555710240 "/home/jerryscript/jerry-core/ecma/operations/ecma-objects.c",
    function=0x555555711800 <__func__.7446> "ecma_op_object_get_property_names", line=2410) at /home/jerryscript/jerry-core/jrt/jrt-fatals.c:87
#5  0x000055555560f2bb in ecma_op_object_get_property_names (obj_p=0x5555558a4e28 <jerry_global_heap+392>, opts=6)
    at /home/jerryscript/jerry-core/ecma/operations/ecma-objects.c:2410
#6  0x00005555556e2307 in opfunc_for_in (left_value=395, result_obj_p=0x7fffffffd8e0) at /home/jerryscript/jerry-core/vm/opcodes.c:295
#7  0x000055555566d30f in vm_loop (frame_ctx_p=0x7fffffffda00) at /home/jerryscript/jerry-core/vm/vm.c:3341
#8  0x0000555555671b2b in vm_execute (frame_ctx_p=0x7fffffffda00) at /home/jerryscript/jerry-core/vm/vm.c:4124
#9  0x00005555556721b0 in vm_run (bytecode_header_p=0x5555558a5018 <jerry_global_heap+888>, this_binding_value=27, lex_env_p=0x5555558a4cd0 <jerry_global_heap+48>,
    arg_list_p=0x0, arg_list_len=0) at /home/jerryscript/jerry-core/vm/vm.c:4232
#10 0x000055555565ec40 in vm_run_global (bytecode_p=0x5555558a5018 <jerry_global_heap+888>) at /home/jerryscript/jerry-core/vm/vm.c:321
#11 0x00005555555ac1d1 in jerry_run (func_val=291) at /home/jerryscript/jerry-core/api/jerry.c:596
#12 0x00005555555a8c98 in main (argc=2, argv=0x7fffffffe118) at /home/jerryscript/jerry-main/main-unix.c:759