ASSERT(jsvHasChildren(obj)) FAILED AT src/jsvar.c:3015

[Limesss]

Reproduce make Debug=1

POC

function foo(o, p)
{
    return o instanceof p;
}

// noInline(foo);

class Foo { }

function Bar() { }
Bar.prototype = new Foo();

new Foo().thingy = 42;

for (var i = 0; i < 10000; ++i) {
    var result = foo(new Bar(), Foo);
    if (!result)
        throw "Error: bad result in loop: " + result;
}

Bar.prototype.__proto__ = null;

var result = foo(new Bar(), Foo);
if (result)
    throw "Error: bad result at end: " + result;

ASSERT(jsvHasChildren(obj)) FAILED AT src/jsvar.c:3015

1[r2,l2] Object {

#2[r1,l2] Name String [1 blocks] "\xFF"      #3[r1,l1] Object { 
    #6[r1,l2] Name String [1 blocks] "timers"          #7[r2,l0] Array(0) [ ] 
    #8[r1,l2] Name String [1 blocks] "watches"          #9[r2,l0] Array(0) [ ] 
  } 
#11[r1,l2] Name String [1 blocks] "quit"      #10[r1,l0] NativeFunction 0x2c2b9100 (0) { } 
#33[r1,l3] Name String [1 blocks] "foo"      #34[r1,l1] Function { return 
    #35[r1,l2] Name Param "\xFFo"           undefined 
    #36[r1,l2] Name Param "\xFFp"           undefined 
    #38[r1,l2] Name String [1 blocks] "\xFFcod"          #37[r1,l2] String [1 blocks] "o instanceof p;"  
  } 
#39[r1,l2] Name String [1 blocks] "Foo"      #40[r3,l1] Function { 
    #41[r1,l2] Name String [2 blocks] "prototype"          #43[r1,l1] Object { 
        #44[r1,l2] Name String [2 blocks] "constructor"              #40[r3,l1] ...

      } 
  } 
#46[r1,l2] Name String [1 blocks] "Bar"      #47[r2,l0] Function { 
    #51[r1,l2] Name String [2 blocks] "prototype"          #53[r2,l0] Object { 
        #54[r1,l2] Name String [2 blocks] "__proto__"              #61[r1,l1] Unknown 2  
        #50[r1,l2] Name String [2 blocks] "constructor"              #47[r2,l0] ...

      } 
  } 
#56[r1,l2] Name String [1 blocks] "i" = int 10000

#49[r1,l3] Name String [1 blocks] "result"      #65[r1,l0] Bool true  

} EXITING.