Assertion ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) in ecma_free_string_list

[renatahodovan]

Jerry version:

Checked revision: b6fc4e13

Build command: ./tools/build.py --clean --debug --compile-flag=-fsanitize=address
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer
--compile-flag=-fno-common --compile-flag=-g
--strip=off --system-allocator=on --logging=on
--linker-flag=-fuse-ld=gold --error-messages=on --profile=es2015-subset

OS:

Linux-4.15.0-50-generic-x86_64-with-Ubuntu-18.04-bionic

Test case:

object = { valueOf: function ( ) { return Symbol ( "foo" ) } };
assert("" + object);

Backtrace:

Script Error: TypeError: Cannot convert a Symbol value to a string.
ICE: Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c(ecma_free_string_list):43.
Error: ERR_FAILED_INTERNAL_ASSERTION

bt
#0  0xf7fd5059 in __kernel_vsyscall ()
#1  0xf7800832 in raise () from /lib/i386-linux-gnu/libc.so.6
#2  0xf7801cc1 in abort () from /lib/i386-linux-gnu/libc.so.6
#3  0x56579af9 in jerry_port_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-port/default/default-fatal.c:71
#4  0x566149db in jerry_fatal (code=ERR_FAILED_INTERNAL_ASSERTION) at jerryscript/jerry-core/jrt/jrt-fatals.c:58
#5  0x56614a1c in jerry_assert_fail (assertion=0x566afc80 "ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)", file=0x566afc00 "jerryscript/jerry-core/ecma/base/ecma-literal-storage.c", function=0x566722c0 <__func__.5035.lto_priv.673> "ecma_free_string_list", line=43) at jerryscript/jerry-core/jrt/jrt-fatals.c:82
#6  0x566668f4 in ecma_free_string_list (string_list_p=0xf5d00710) at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:43
#7  0x56666a30 in ecma_finalize_lit_storage () at jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:63
#8  0x566658bf in ecma_finalize () at jerryscript/jerry-core/ecma/base/ecma-init-finalize.c:66
#9  0x5663c574 in jerry_cleanup () at jerryscript/jerry-core/api/jerry.c:216
#10 0x5663a5ae in main (argc=3, argv=0xffffcbe4) at jerryscript/jerry-main/main-unix.c:940

^{Found by Fuzzinator with grammarinator.}