[FatalInternalError] ReportFatalException7

[bird8693]

enviroment

ubuntu18

poc

if (this.Intl) {
    var pr;
    var suffixes;
    function format(n) {
        return '' + n + suffixes[pr.select(n)];
    }
    pr = new Intl.PluralRules('en-US');
    suffixes = {
        one: ' day',
        other: ' days'
    };
    '0 days';
    format(0);
    '0.5 days';
    var dGSG = -5e-324 == -9007199254740991;
    format(0.5);
    format(1200);
    '1 day';
    format(1);
    '1.5 days';
    format(1.5);
    '2 days';
    format(2);
    pr = new Intl.PluralRules('en-US', { type: 'ordinal' });
    suffixes = {
        one: 'st',
        two: 'nd',
        few: 'rd',
        other: 'th'
    };
    '0th';
    format(0);
    '1st';
    format(1);
    '2nd';
    format(2);
    '3rd';
    format(3);
    '4th';
    format(4);
    '11th';
    var mYri = Symbol;
    format(11);
    '21st';
    format(21);
    '103rd';
    format(103);
    pr = new Intl.PluralRules('ar');
    suffixes = null;
    format(9007199254740992);
    'zero';
    pr.select(0);
    'one';
    var yhEm = 2147483647 == 1073741823;
    pr.select(1);
    'two';
    pr.select(2);
    'few';
    pr.select(3);
    var GRYc = new Float64Array([
        1,
        -9007199254740990,
        -4294967297,
        -4294967295,
        3.141592653589793,
        9007199254740990,
        -5e-324,
        4294967297
    ]);
    'many';
    pr.select(11);
    'other';
    pr.select(100);
    'other';
    pr.select(1.5);
    var SDDr = Proxy;
}

callstack

[#0] 0x555555d59fac → DebugBreak()
[#1] 0x555555d59fac → ReportFatalException(context=<optimized out>, exceptionCode=<optimized out>, reasonCode=<optimized out>, scenario=<optimized out>)
[#2] 0x555555d5a709 → Js::Throw::FatalInternalError(hr=0x7fff7e00)
[#3] 0x55555809865f → Js::IntlEngineInterfaceExtensionObject::EntryIntl_PluralRulesSelect(function=<optimized out>, callInfo=<optimized out>)
[#4] 0x5555577159ee → amd64_CallFunction()
[#5] 0x5555569af5eb → Js::InterpreterStackFrame::OP_CallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > > __unaligned>(Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray<unsigned int> const*)(this=<optimized out>, playout=<optimized out>, function=0x7ffff2171840, flags=0x3, spreadIndices=0x0)
[#6] 0x5555569ae92c → Js::InterpreterStackFrame::OP_ProfileCallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > > __unaligned>(Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray<unsigned int> const*)(this=0x7ffff1fd1000, playout=0x555558a9027e <js::Library_Bytecode_Intl+80126>, function=0x7ffff2171840, flags=0x0, profileId=0x1, inlineCacheIndex=0x1, spreadIndices=0x0)
[#7] 0x55555663bc00 → Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > >(Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<(Js::LayoutSize)0> > > const __unaligned*)(playout=0x555558a9027e <js::Library_Bytecode_Intl+80126>, this=<optimized out>)
[#8] 0x55555663bc00 → Js::InterpreterStackFrame::ProcessProfiled(this=<optimized out>)
[#9] 0x555556568236 → Js::InterpreterStackFrame::Process(this=<optimized out>)

[rhuanjl]

This doesn't repro for me with the master branch.

[rhuanjl]

Fixed in #6660