Assertion 'ecma_is_value_integer_number (value)' failed in ecma_get_integer_from_value

[renatahodovan]

Jerry version:

Checked revision: adb80c20

Build command: ./tools/build.py --clean --debug --compile-flag=-m32 --profile=es2015-subset --system-allocator=on --error-messages=on --logging=on

OS:

Linux-4.15.0-43-generic-x86_64-with-Ubuntu-18.04-bionic

Test case:

Promise.race(new Array(0xfffffffe)); 

Backtrace:

ICE: Assertion 'ecma_is_value_integer_number (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_get_integer_from_value):611.
Error: ERR_FAILED_INTERNAL_ASSERTION

Program received signal SIGABRT, Aborted.
0xf7fd5059 in __kernel_vsyscall ()
(gdb) bt
#0  0xf7fd5059 in __kernel_vsyscall ()
#1  0xf7de1832 in raise () from /lib/i386-linux-gnu/libc.so.6
#2  0xf7de2cc1 in abort () from /lib/i386-linux-gnu/libc.so.6
#3  0x5655c93a in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-port/default/default-fatal.c:71
#4  0x5659f587 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x5659f5c1 in jerry_assert_fail (assertion=0x565e3948 "ecma_is_value_integer_number (value)", file=0x565e37ec "jerryscript/jerry-core/ecma/base/ecma-helpers-value.c", 
    function=0x565cd0d8 <__func__.3339.lto_priv.664> "ecma_get_integer_from_value", line=611) at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x565c419f in ecma_get_integer_from_value (value=1450137234) at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:611
#7  0x565814dd in ecma_builtin_promise_do_race (array=1450137299, capability=1450137331, ctor=1450137075) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c:208
#8  0x56582118 in ecma_builtin_promise_race_or_all (this_arg=1450137075, array=1450137299, is_race=true) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c:598
#9  0x56582184 in ecma_builtin_promise_race (this_arg=1450137075, array=1450137299) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c:628
#10 0x56581035 in ecma_builtin_promise_dispatch_routine (builtin_routine_id=62, this_arg_value=1450137075, arguments_list=0xffffd05c, arguments_number=1)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-promise.inc.h:42
#11 0x565a5c5d in ecma_builtin_dispatch_routine (builtin_object_id=ECMA_BUILTIN_ID_PROMISE, builtin_routine_id=62, this_arg_value=1450137075, arguments_list_p=0xffffd05c, arguments_list_len=1)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:952
#12 0x565a5da8 in ecma_builtin_dispatch_call (obj_p=0x566f5610, this_arg_value=1450137075, arguments_list_p=0xffffd05c, arguments_list_len=1)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.c:977
#13 0x565ad4f1 in ecma_op_function_call (func_obj_p=0x566f5610, this_arg_value=1450137075, arguments_list_p=0xffffd05c, arguments_list_len=1)
    at jerryscript/jerry-core/ecma/operations/ecma-function-object.c:645
#14 0x5658c0df in opfunc_call (frame_ctx_p=0xffffd07c) at jerryscript/jerry-core/vm/vm.c:526
#15 0x56591b8a in vm_execute (frame_ctx_p=0xffffd07c, arg_p=0x0, arg_list_len=0) at jerryscript/jerry-core/vm/vm.c:3455
#16 0x56591d8d in vm_run (bytecode_header_p=0x566f55a0, this_binding_value=1450135939, lex_env_p=0x566f51b0, parse_opts=0, arg_list_p=0x0, arg_list_len=0)
    at jerryscript/jerry-core/vm/vm.c:3552
#17 0x5658bb82 in vm_run_global (bytecode_p=0x566f55a0) at jerryscript/jerry-core/vm/vm.c:227
#18 0x565b43b4 in jerry_run (func_val=1450137043) at jerryscript/jerry-core/api/jerry.c:544
#19 0x565b2d7c in main (argc=3, argv=0xffffd314) at jerryscript/jerry-main/main-unix.c:676

^{Found by Fuzzinator with grammarinator.}