

###### JerryScript revision
2faafa4
###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)

###### Build steps
···
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
···
###### Test case
···
var count = "0000";
var arr = Math.cos;
function func(val) {
    if (count++ > 300)
        return;
    try { arr = new Float32Array([Symbol('a'), 1]);
    } catch(e) {}
    arr[i] = -1;
    try { Object.setPrototypeOf(arr, new Int8Array(arr)); } catch(e) {}
}

for (var i=0; i<10; i ++) {
    func(new Proxy(func, []));
}

···

###### Output
···
ICE: Assertion 'ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_NAMEDDATA || ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_VIRTUAL' failed at /root/jerryscript/jerry-core/ecma/base/ecma-helpers.c(ecma_is_property_writable):1035.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted

···
Credits: Found by chong from OWL337.
Assertion 'ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_NAMEDDATA || ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_VIRTUAL' in ecma_is_property_writable
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : Assertion 'ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_NAMEDDATA || ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_VIRTUAL' in ecma_is_property_writable
Issue date:

--- start body ---


###### JerryScript revision
2faafa4
###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)

###### Build steps
···
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
···
###### Test case
···
var count = "0000";
var arr = Math.cos;
function func(val) {
    if (count++ > 300)
        return;
    try { arr = new Float32Array([Symbol('a'), 1]);
    } catch(e) {}
    arr[i] = -1;
    try { Object.setPrototypeOf(arr, new Int8Array(arr)); } catch(e) {}
}

for (var i=0; i<10; i ++) {
    func(new Proxy(func, []));
}

···

###### Output
···
ICE: Assertion 'ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_NAMEDDATA || ECMA_PROPERTY_GET_TYPE (property) == ECMA_PROPERTY_TYPE_VIRTUAL' failed at /root/jerryscript/jerry-core/ecma/base/ecma-helpers.c(ecma_is_property_writable):1035.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted

···
Credits: Found by chong from OWL337.
--- end body ---

An internal assertion failure in JerryScript v2faafa4 occurs when the property type is neither ECMA_PROPERTY_TYPE_NAMEDDATA nor ECMA_PROPERTY_TYPE_VIRTUAL. This can lead to a Denial of Service (DoS) as the program aborts unexpectedly when the assertion fails.