Assertion ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) in ecma_free_string_list

[renatahodovan]

Jerry version:

Checked revision: 8e39fbc4
Build command: ./tools/build.py --clean --debug --error-messages=on --logging=on

OS:

Linux-4.15.0-47-generic-x86_64-with-Ubuntu-18.04-bionic

Test case:

Object.defineProperties(constructor, { $: Object })
JSON.parse('{"a":1}', function (k) {
  if (k) { $ *= $ }
})
var $ = Object.freeze(RegExp($, 'g')).exec()

Backtrace:

Script Error: ReferenceError: person is not defined
ICE: Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c(ecma_free_string_list):43.
Error: ERR_FAILED_INTERNAL_ASSERTION

bt
#0  0xf7fd5059 in __kernel_vsyscall ()
#1  0xf77f9832 in raise () from /lib/i386-linux-gnu/libc.so.6
#2  0xf77facc1 in abort () from /lib/i386-linux-gnu/libc.so.6
#3  0x56579a19 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-port/default/default-fatal.c:71
#4  0x56614f99 in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x56614fda in jerry_assert_fail (assertion=0x566aec40 "ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)", file=0x566aebc0 "jerryscript/jerry-core/ecma/base/ecma-literal-storage.c", function=0x566710e0 <__func__.5048.lto_priv.663> "ecma_free_string_list", line=43) at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x566656ca in ecma_free_string_list (string_list_p=0xf5d004d0) at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:43
#7  0x56665806 in ecma_finalize_lit_storage () at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:63
#8  0x56664695 in ecma_finalize () at jerryscript/jerry-core/ecma/base/ecma-init-finalize.c:66
#9  0x5663c015 in jerry_cleanup () at jerryscript/jerry-core/api/jerry.c:216
#10 0x5663a06a in main (argc=3, argv=0xffffce34) at jerryscript/jerry-main/main-unix.c:940

^{Found by Fuzzinator with grammarinator.}