Assertion 'ecma_is_value_object (value)' failed in ecma-helpers-value(ecma_get_object_from_value)

[hope-fly]

JerryScript revision

Commit: 51da1551 Version: v3.0.0

Commit: 8ba0d1b Version: v2.4.0

Build platform

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86_64)

Build steps

./tools/build.py --clean --debug --profile=es2015-subset --compile-flag=-fsanitize=address --compile-flag=-m32 --lto=off --logging=on --line-info=on --error-message=on --system-allocator=on --stack-limit=20

Test case

function JSEtest(proxyTarget) {
  var {
    proxy,
    revoke
  } = Proxy.revocable(proxyTarget, new Proxy({}, {
    get(target, propertyKey, receiver) {
      revoke();
    }
  }));
  return proxy;
}

Object.getPrototypeOf(JSEtest({}));

​

Execution steps & Output

$ ./jerryscript/build/bin/jerry poc.js

ICE: Assertion 'ecma_is_value_object (value)' failed at /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_get_object_from_value):838.
Error: ERR_FAILED_INTERNAL_ASSERTION

Jerry-V3.0.0 and V2.4.0 have the same Backtrace.

Credits: Found by OWL337 team.