Closed
Description
Jerry version:
Checked revision: e8608707
Build command: ./tools/build.py --clean --debug
OS:
Ubuntu 17.10
Test case:
var id_0 = Object.prototype.toString ;
Object.prototype.toString = function ( ) { return "SHIFTED" } ;
RegExp ( '#1: __str = new String({}); typeof __str === "object". Actual: typeof __str ===');Backtrace:
ICE: Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c(ecma_free_string_list):43.
Error: ERR_FAILED_INTERNAL_ASSERTION
Program received signal SIGABRT, Aborted.
0xf7fd5db9 in __kernel_vsyscall ()
(gdb) bt
#0 0xf7fd5db9 in __kernel_vsyscall ()
#1 0xf7ca57e2 in raise () from /lib/i386-linux-gnu/libc.so.6
#2 0xf7ca6f51 in abort () from /lib/i386-linux-gnu/libc.so.6
#3 0x082d09bc in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION)
at jerryscript/jerry-port/default/default-fatal.c:71
#4 0x081f9c67 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5 0x081f9ce1 in jerry_assert_fail (assertion=0x8308aa0 <.str.2> "ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)",
file=0x83089c0 <.str.1> "jerryscript/jerry-core/ecma/base/ecma-literal-storage.c",
function=0x8308b00 <__func__.ecma_free_string_list> "ecma_free_string_list", line=43)
at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6 0x081ba367 in ecma_free_string_list (string_list_p=0xf5f00710)
at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:43
#7 0x081ba187 in ecma_finalize_lit_storage () at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:60
#8 0x081b8b64 in ecma_finalize () at jerryscript/jerry-core/ecma/base/ecma-init-finalize.c:65
#9 0x08172db9 in jerry_cleanup () at jerryscript/jerry-core/api/jerry.c:222
#10 0x0816ef06 in main (argc=3, argv=0xffffcea4) at jerryscript/jerry-main/main-unix.c:763
Found by Fuzzinator with grammarinator.