Assertion failure in Lowerer::MapStFldHelper

[zhunki]

the following poc trigger a assertion failure in "debug" build on ubuntu.

function opt(opt_param){
class V2 {
    print() {
        if (opt_param) {
        } 
    }
};

if (opt_param) {
}
const v12 = [];
const v19 = {constructor:parseFloat};
v12.constructor = RangeError;
v19.valueOf = parseFloat;
}
for(let i=0;i<0x200;i++){opt(false);}

#0 0x00005555568c8420 in Lowerer::MapStFldHelper (this=0x7ff7efffd7b0,
propertySymOpnd=0x7ff7f4304eb8, helperMethod=@0x7ff7efffc094: IR::HelperOp_InitClassMember,
polymorphicHelperMethod=@0x7ff7efffc090: IR::HelperOp_InitClassMember)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/Lower.cpp:7221
#1 0x0000555556889c4b in Lowerer::LowerStFld (this=0x7ff7efffd7b0, stFldInstr=0x7ff7f43093f0,
helperMethod=IR::HelperOp_InitClassMember,
polymorphicHelperMethod=IR::HelperOp_InitClassMember, withInlineCache=false, labelBailOut=0x0,
isHelper=false, withPutFlags=false, flags=Js::PropertyOperation_None)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/Lower.cpp:7101
#2 0x0000555556887c77 in Lowerer::LowerRange (this=0x7ff7efffd7b0, instrStart=0x7ff7f4302170,
instrEnd=0x7ff7f43021d0, defaultDoFastPath=true, defaultDoLoopFastPath=true)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/Lower.cpp:2562
#3 0x000055555687d5a1 in Lowerer::Lower (this=0x7ff7efffd7b0)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/Lower.cpp:104
#4 0x0000555556b28bbb in Func::TryCodegen (this=0x7ff7efffdfa0)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/Func.cpp:475
#5 0x0000555556b28330 in Func::Codegen (alloc=0x7ff7efffe560, workItem=0x7ff7f42f1030,
threadContextInfo=0x555557ebeea8, scriptContextInfo=0x555557ef0d08, outputData=0x7ff7efffe9a0,
epInfo=0x7ff7f43c8090, runtimeInfo=0x0, polymorphicInlineCacheInfo=0x7ff7f432a540,
codeGenAllocators=0x555557ef52d8, codeGenProfiler=0x0, isBackgroundJIT=true)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/Func.cpp:325
#6 0x000055555694bdc0 in NativeCodeGenerator::CodeGen (this=0x555557ef24d8, pageAllocator=
0x5555575a9da8, workItemData=0x555557f01d30, jitWriteData=..., foreground=false,
epInfo=0x7ff7f43c8090)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/NativeCodeGenerator.cpp:890
#7 0x000055555694da58 in NativeCodeGenerator::CodeGen (this=0x555557ef24d8,
pageAllocator=0x5555575a9da8, workItem=0x555557f01d08, foreground=false)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/NativeCodeGenerator.cpp:1007
#8 0x0000555556950854 in NativeCodeGenerator::Process (this=0x555557ef24d8, job=0x555557f01d10,
threadData=0x5555575a9d88)
at /home/zhunki/workspace/ChakraCore-master/lib/Backend/NativeCodeGenerator.cpp:1907
#9 0x00005555569bc7a1 in JsUtil::BackgroundJobProcessor::Process (this=0x555557ef2658,
job=0x555557f01d10, threadData=0x5555575a9d88)
at /home/zhunki/workspace/ChakraCore-master/lib/Common/Common/Jobs.cpp:1037
#10 0x00005555569bcda4 in JsUtil::BackgroundJobProcessor::Run (this=0x555557ef2658,
threadData=0x5555575a9d88)
at /home/zhunki/workspace/ChakraCore-master/lib/Common/Common/Jobs.cpp:1135
#11 0x00005555569ba351 in JsUtil::BackgroundJobProcessor::StaticThreadProc (lpParam=0x5555575a9d88)
at /home/zhunki/workspace/ChakraCore-master/lib/Common/Common/Jobs.cpp:1319
#12 0x00005555558308d0 in CorUnix::CPalThread::ThreadEntry (pvParam=0x555557ef2dd0)
at /home/zhunki/workspace/ChakraCore-master/pal/src/thread/pal_thread.cpp:1605
#13 0x00007ffff7aa2609 in start_thread (arg=) at pthread_create.c:477
#14 0x00007ffff7857293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[ppenzin]

MapStFldHelper doesn't accept HelperOp_InitClassMember.