Assertion 'ecma_is_value_object (value)' in ecma_get_object_from_value

[owl337]

JerryScript revision

585332f

Build platform

Ubuntu 16.04.6 LTS (Linux 4.15.0-99-generic x86_64)

Build steps

./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
 --compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
 --compile-flag=-fno-common --compile-flag=-g --strip=off \
 --system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
 --error-messages=on --profile=es2015-subset --lto=off 

Test case

this.RegExp.prototype.constructor = "'detailForm','detailForm:j_id166', []);\" ><img alt=\"Export to XLS format\" />\n</a>"
r = /'(detailForm:j_id\d+)'[^>]+>[^>]+Export to XLS format/;

Output

ICE: Assertion 'ecma_is_value_object (value)' failed at /home/JerryScript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_get_object_from_value):793.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted

Credits: This vulnerability is detected by chong from OWL337.