[FatalInternalError] ReportFatalException8

[bird8693]

enviroment

ubuntu18

poc

if (this.Intl) {
    var pr;
    var suffixes;
    function format(n) {
        return '' + n + suffixes[pr.select(n)];
    }
    pr = new Intl.PluralRules('en-US');
    suffixes = {
        one: ' day',
        other: ' days'
    };
    '0 days';
    format(0);
    '0.5 days';
    format(0.5);
    '1 day';
    format(1);
    '1.5 days';
    format(1.5);
    '2 days';
    format(2);
    pr = new Intl.PluralRules('en-US', { type: 'ordinal' });
    suffixes = {
        one: 'st',
        two: 'nd',
        few: 'rd',
        other: 'th'
    };
    '0th';
    format(0);
    '1st';
    format(1);
    '2nd';
    format(2);
    '3rd';
    for (var ijjkkk = 0; ijjkkk < 100000; ++ijjkkk) {
        var FPAn = format(3);
    }
    format(3);
    '4th';
    format(4);
    '11th';
    format(11);
    '21st';
    format(21);
    '103rd';
    format(103);
    JSON.stringify(759250124);
    pr = new Intl.PluralRules('ar');
    suffixes = null;
    var awYX = Date;
    'zero';
    pr.select(0);
    var TYHh = Reflect;
    'one';
    pr.select(1);
    'two';
    pr.select(2);
    'few';
    pr.select(3);
    var kxjR = 1073741825 ** -2147483648;
    format(-9007199254740994);
    'many';
    var CHkP = 1200 >= -1.7976931348623157e+308;
    pr.select(11);
    'other';
    pr.select(100);
    'other';
    pr.select(1.5);
    format(-1.7976931348623157e+308);
}

callstack

[#0] Id 1, Name: "ch_asan18", stopped 0x555555d59fac in DebugBreak (), reason: SIGILL
[#1] Id 2, Name: "ch_asan18", stopped 0x7ffff73d1360 in pthread_cond_wait@@GLIBC_2.3.2 (), reason: SIGILL
[#2] Id 3, Name: "ch_asan18", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGILL
[#3] Id 4, Name: "ch_asan18", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGILL
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x555555d59fac → DebugBreak()
[#1] 0x555555d59fac → ReportFatalException(context=<optimized out>, exceptionCode=<optimized out>, reasonCode=<optimized out>, scenario=<optimized out>)
[#2] 0x555555d5a709 → Js::Throw::FatalInternalError(hr=0x7fff7e00)
[#3] 0x55555809865f → Js::IntlEngineInterfaceExtensionObject::EntryIntl_PluralRulesSelect(function=<optimized out>, callInfo=<optimized out>)
[#4] 0x7ffff1f301ce → mov rbx, rax
[#5] 0x7ffff21718c0 → shl BYTE PTR [rax+0x555558fb], 1

[rhuanjl]

Looks like the same issue as #6630 but similarly not repro-ing for me in master

[rhuanjl]

I think this is fixed in master.