ASSERTION Failure: (!Js::TaggedInt::Is(right)) in ChakraCore/lib/Backend/GlobOpt.cpp

[anbu1024]

commit

41ad58a9eebf8d52a83424c8fccfaacdb14105ec

Build platform

Ubuntu 20.04

Build steps

./build.sh --debug

poc

function foo() {
    var x = new bar();
}

function bar() {
    foo();
    WebAssembly[0 === 1 ? keys : valueOf];
    return {};
}

WScript.Attach(bar);

assert log

ASSERTION 2405716: (/media/Store/Project/js-engines/ChakraCore/lib/Backend/GlobOpt.cpp, line 6709) !Js::TaggedInt::Is(right)
 Failure: (!Js::TaggedInt::Is(right))
Illegal instruction