Assertion ecma_get_value_type_field (value) == ECMA_TYPE_DIRECT || ecma_get_value_type_field (value) == ECMA_TYPE_DIRECT_STRING in ecma_free_value

[renatahodovan]

JerryScript revision

2975810

Build platform

Linux-4.15.0-54-generic-x86_64-with-Ubuntu-18.04-bionic

Build steps

./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g \
--strip=off --system-allocator=on --logging=on \
--linker-flag=-fuse-ld=gold --error-messages=on --profile=es2015-subset

Test case

var map = new Map()
map.set([0])

Output

ICE: Assertion 'ecma_get_value_type_field (value) == ECMA_TYPE_DIRECT || ecma_get_value_type_field (value) == ECMA_TYPE_DIRECT_STRING' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_free_value):1080.
Error: ERR_FAILED_INTERNAL_ASSERTION

Backtrace

bt
#0  0xf7fd5059 in __kernel_vsyscall ()
#1  0xf77fc832 in raise () from /lib/i386-linux-gnu/libc.so.6
#2  0xf77fdcc1 in abort () from /lib/i386-linux-gnu/libc.so.6
#3  0x5657ac87 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-port/default/default-fatal.c:71
#4  0x566173a1 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x566173e2 in jerry_assert_fail (assertion=0x566b6d00 "ecma_get_value_type_field (value) == ECMA_TYPE_DIRECT || ecma_get_value_type_field (value) == ECMA_TYPE_DIRECT_STRING", file=0x566b65e0 "jerryscript/jerry-core/ecma/base/ecma-helpers-value.c", function=0x56678ae0 <__func__.3788.lto_priv.690> "ecma_free_value", line=1080) at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x56664e2e in ecma_free_value (value=3200171710) at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:1079
#7  0x56664e8f in ecma_free_value_if_not_object (value=3200171710) at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:1114
#8  0x5664b14e in ecma_free_fast_access_array (object_p=0xf5f00760) at jerryscript/jerry-core/ecma/base/ecma-gc.c:588
#9  0x5664b3b6 in ecma_gc_free_object (object_p=0xf5f00760) at jerryscript/jerry-core/ecma/base/ecma-gc.c:621
#10 0x5664cd56 in ecma_gc_run () at jerryscript/jerry-core/ecma/base/ecma-gc.c:1066
#11 0x5666abf7 in ecma_finalize () at jerryscript/jerry-core/ecma/base/ecma-init-finalize.c:63
#12 0x5663ffa3 in jerry_cleanup () at jerryscript/jerry-core/api/jerry.c:216
#13 0x5663dfb0 in main (argc=3, argv=0xffffcc14) at jerryscript/jerry-main/main-unix.c:941

^{Found by Fuzzinator with grammarinator.}