ASSERTION: ChakraCore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 570

[anbu1024]

ChakraCore version:
commit c3ead3f

Build cmd:

./build.sh --debug --static

Test case:

function foo() {
	
	function bar(v1,v2,v3) {
	}
	
	function* baz(v5,v6) {
	}
	
	const a = baz();

	bar.__proto__ = a;
	
	delete bar.length;
	
	for (const i in bar) {
		z = v14;
	}
	
	bar.length = 0;
}

for(let i=0; i<0x300; i++) {
	foo();
}

Execute

./ch --bgjit --oopjit ./test.js

Error msg:

ASSERTION 2624246: (ChakraCore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 570) !GetIsLocked()
 Failure: (!GetIsLocked())
Illegal instruction (core dumped)