###### JerryScript revision

Commit: [a6ab5e9](https://github.com/jerryscript-project/jerryscript/commit/a6ab5e9abed70cdedf9f4e9c1dc379eb762ebf64)

Version: v3.0.0



###### Build platform

Ubuntu 18.04.5 LTS (Linux 4.19.128-microsoft-standard x86_64)

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)



###### Build steps

```bash
python ./tools/build.py --clean --debug --compile-flag=-fsanitize=address --compile-flag=-m32 --compile-flag=-g --strip=off --lto=off --logging=on --line-info=on --error-message=on --system-allocator=on --stack-limit=20
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
class JSEtest {
  #m = async function() { return 'test262'; };

  method() {
    return this.#m();
  m
}

let c = new JSEtest();

c.method().then((value) => assert.sameValue(value, 'test262'))
  .then($DONE, $DONE);
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./jerryscript/build/bin/jerry poc.js

ICE: Assertion 'page_p != list_p->data.last_p || (index * list_p->item_size < list_p->data.last_position)' failed at jerryscript/jerry-core/parser/js/js-parser-mem.c(parser_list_get):280.
Error: ERR_FAILED_INTERNAL_ASSERTION
[1]    35666 abort      jerry poc.js
```

Credits: Found by OWL337 team.
Assertion 'page_p != list_p->data.last_p || (index * list_p->item_size < list_p->data.last_position)' failed at jerryscript/jerry-core/parser/js/js-parser-mem.c(parser_list_get):280.
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : Assertion 'page_p != list_p->data.last_p || (index * list_p->item_size < list_p->data.last_position)' failed at jerryscript/jerry-core/parser/js/js-parser-mem.c(parser_list_get):280.
Issue date:

--- start body ---
###### JerryScript revision

Commit: [a6ab5e9](https://github.com/jerryscript-project/jerryscript/commit/a6ab5e9abed70cdedf9f4e9c1dc379eb762ebf64)

Version: v3.0.0



###### Build platform

Ubuntu 18.04.5 LTS (Linux 4.19.128-microsoft-standard x86_64)

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)



###### Build steps

```bash
python ./tools/build.py --clean --debug --compile-flag=-fsanitize=address --compile-flag=-m32 --compile-flag=-g --strip=off --lto=off --logging=on --line-info=on --error-message=on --system-allocator=on --stack-limit=20
```



###### Test case
<details>
<summary>poc.js</summary>
<pre><code>

```javascript
class JSEtest {
  #m = async function() { return 'test262'; };

  method() {
    return this.#m();
  m
}

let c = new JSEtest();

c.method().then((value) => assert.sameValue(value, 'test262'))
  .then($DONE, $DONE);
```
</code></pre>
</details>
​	

###### Execution steps & Output

```bash
$ ./jerryscript/build/bin/jerry poc.js

ICE: Assertion 'page_p != list_p->data.last_p || (index * list_p->item_size < list_p->data.last_position)' failed at jerryscript/jerry-core/parser/js/js-parser-mem.c(parser_list_get):280.
Error: ERR_FAILED_INTERNAL_ASSERTION
[1]    35666 abort      jerry poc.js
```

Credits: Found by OWL337 team.
--- end body ---

An internal assertion failure in JerryScript v3.0.0 occurs when executing a specific JavaScript code snippet, leading to a potential Denial of Service (DoS) due to the program aborting unexpectedly. The assertion failure indicates a possible memory corruption or invalid state in the parser's internal data structures, which could be exploited by an attacker to crash the interpreter.