Assertion error: bad type object in conversion ToInteger

[anbu1024]

ChakraCore version: commit c3ead3f

Build cmd:

./build.sh --debug --static

Test case:

function test(){
    async function foo(a1,a2) {

        for (let i = a2; i < a1; i = i ** foo) {
            const x = await i;
        }

        function bar () {
        }

        const u = new Uint8Array(bar);
        const p = new Proxy(u,Reflect);
        const o = Object.seal(p);
    }

    const r = foo();
    return r;
}

for(let i=0; i<1024; i++){
    test();
}

Execute

./ch ./test.js

Error msg:

ASSERTION 2791936: (ChakraCore/lib/Runtime/Language/JavascriptConversion.cpp, line 938) bad type object in conversion ToInteger
 Failure: (JavascriptOperators::IsObject(aValue))
Illegal instruction

[rhuanjl]

This is one of a number of bugs in the jitting of generator functions.

See #6293 #6533 #6662 #6684 #6700 and #6706 for progress on this area - I think currently we are planning to disable it by default before making any released version; it's a shame but I fear its implementation is just too fragile.