There is an Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at /jerry-core/ecma/base/ecma-helpers.c in JerryScript 3.0.0.
###### JerryScript revision

Commit: [a6ab5e9](https://github.com/jerryscript-project/jerryscript/commit/a6ab5e9abed70cdedf9f4e9c1dc379eb762ebf64)

Version: v3.0.0



###### Build platform

Ubuntu 18.04.5 LTS (Linux 4.19.128-microsoft-standard x86_64)

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)



###### Build steps

```bash
python ./tools/build.py --clean --debug --compile-flag=-fsanitize=address --compile-flag=-m32 --compile-flag=-g --strip=off --lto=off --logging=on --line-info=on --error-message=on --system-allocator=on --stack-limit=20
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
class JSEtest {
    static set #m(v) {
        this._v = v;
    }

    static setWithEval() {
        eval(' [1].#m = "Test262"');
    }
}

class D {
    static set #m(v) {
        throw new Test262Error('should never be called');
    }
}

JSEtest.setWithEval();
assert.sameValue(JSEtest._v, 'Test262');

assert.throws(TypeError, function () {
    JSEtest.getWithEval.call(D);
}, 'invalid access to a static private getter');
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./jerryscript/build/bin/jerry poc.js

ICE: Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers.c(ecma_find_named_property):621.
Error: ERR_FAILED_INTERNAL_ASSERTION
[1]    5397 abort      jerry poc.js
```
Credits: Found by OWL337 team.

Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers.c(ecma_find_named_property):621.
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers.c(ecma_find_named_property):621.
Issue date:

--- start body ---
###### JerryScript revision

Commit: [a6ab5e9](https://github.com/jerryscript-project/jerryscript/commit/a6ab5e9abed70cdedf9f4e9c1dc379eb762ebf64)

Version: v3.0.0



###### Build platform

Ubuntu 18.04.5 LTS (Linux 4.19.128-microsoft-standard x86_64)

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)



###### Build steps

```bash
python ./tools/build.py --clean --debug --compile-flag=-fsanitize=address --compile-flag=-m32 --compile-flag=-g --strip=off --lto=off --logging=on --line-info=on --error-message=on --system-allocator=on --stack-limit=20
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
class JSEtest {
    static set #m(v) {
        this._v = v;
    }

    static setWithEval() {
        eval(' [1].#m = "Test262"');
    }
}

class D {
    static set #m(v) {
        throw new Test262Error('should never be called');
    }
}

JSEtest.setWithEval();
assert.sameValue(JSEtest._v, 'Test262');

assert.throws(TypeError, function () {
    JSEtest.getWithEval.call(D);
}, 'invalid access to a static private getter');
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./jerryscript/build/bin/jerry poc.js

ICE: Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers.c(ecma_find_named_property):621.
Error: ERR_FAILED_INTERNAL_ASSERTION
[1]    5397 abort      jerry poc.js
```
Credits: Found by OWL337 team.

--- end body ---

An assertion failure in JerryScript v3.0.0 indicates a potential vulnerability related to the handling of private static properties in JavaScript classes. The failure occurs when the code attempts to access a private static setter through eval, which should not be allowed. This could lead to unexpected behavior or crashes, suggesting a flaw in the implementation of private property access.