Actually, the assertion in the spec comes from https://github.com/tc39/ecma262/pull/2413 which is reflected to SpiderMonkey in bug 1724123, version 97. I've confirmed the crash happens on 97, but not on 96. Then, I don't see the corresponding update in v8 code nor JSC code, so I assume the problematic change is not reflected there.
Bug 1901411 Comment 9 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Actually, the assertion in the spec comes from https://github.com/tc39/ecma262/pull/2413 which is reflected to SpiderMonkey in bug 1724123, version 97. I've confirmed the crash happens on 97, but not on 96. Then, I don't see the corresponding update in v8 code nor JSC code (at least the building blocks I see in their code seems to be based on ECMAScript 2021's abstract operations' names), so I assume the problematic change is not reflected there.
Actually, the assertion in the spec comes from https://github.com/tc39/ecma262/pull/2413 which is reflected to SpiderMonkey in bug 1724123, version 97. I've confirmed the crash happens on 97, but not on 96. Then, I don't see the corresponding update in v8 code nor JSC code (at least the building blocks I see in their code seems to be based on ECMAScript 2021's abstract operations' names which is before https://github.com/tc39/ecma262/pull/2413), so I assume the problematic change is not reflected there.