segment fault7

[bird8693]

enviroment

ubuntu 16

poc

function f(o) {
    var a = [o];
    var Nwmi = +NaN;
    JSON.parse(null);
    var bSSJ = escape('valueOf');
    var KQHr = Reflect;
    var TTsS = delete 643;
    for (var ijjkkk = 0; ijjkkk < 718; ++ijjkkk) {
        var GRQK = Symbol;
    }
    var GhQz = 10000 < 1;
    a.length = a[0];
    var Azdx = Proxy;
    var Zzdr = 1073741823 > NaN;
    var wQhB = a.copyWithin(function () {
    }, a, delete NaN, delete NaN);
    a.includes(0.864734415213608, -1.7976931348623157e+308);
    var rHma = JSON.stringify(2147483648);
    a = new Int32Array([a]);
    var xZks = Error;
    a.includes(0.864734415213608, -1.7976931348623157e+308);
    var PmTw = 1e+81 != 673720360;
    var QwbG = a.join(-9007199254740994, a, -9007199254740994);
    var GZjn = wQhB >= 0.45272880800563353;
    var aEZf = ~1;
    var eAzM = Reflect;
    var fMXC = a.filter(function () {
    }, a);
    var RNXf = 759250124 % 2147483648;
    var swnp = new RegExp(null);
    var HEAT = 0.572013939871763 > i;
    var Zzdr = 1073741823 > NaN;
    return Array.prototype['NaN'];
    var AYDC = unescape('({})');
    var useless = function () {
    };
    var nkPX = new Array([
        0,
        401,
        0,
        -4294967297
    ]);
    var zycp = unescape('undefined');
    useless(new Boolean(false));
    HEAT = -4294967297 >>> -4294967296;
    var RNXf = 759250124 % 2147483648;
    var useless = function () {
    };
    for (var ijjkkk = 0; ijjkkk < 100000; ++ijjkkk) {
        var mzEw = void NaN;
        var FTah = Reflect;
    }
    var ahEC = JSON.stringify(-9007199254740990);
}
var bSSJ = escape('valueOf');
for (var i = 0; i < 772; i++) {
    var nkPX = new Array([
        0,
        401,
        0,
        -4294967297
    ]);
    for (var ijjkkk = 0.16589075493654648; ijjkkk < 0.4270652992850741; ++ijjkkk) {
        var GRQK = Symbol;
    }
    f(2);
    JSON.parse(null);
    var rYBc = -9007199254740992 > 9007199254740990;
}
f(2);
NWrQ = QwbG.lastIndexOf(QwbG, xDQS);
var sCBx = new BigInt64Array([
    -9007199254740992,
    5e-324,
    -Infinity,
    NaN,
    9007199254740994,
    -1.7976931348623157e+308,
    NaN
]);

gef output

   0x7ff7f2f594c5                  mov    rdx, rax
   0x7ff7f2f594c8                  shr    rdx, 0x30
   0x7ff7f2f594cc                  jne    0x7ff7f2f59ad8
 → 0x7ff7f2f594d2                  mov    rdx, QWORD PTR [rax+0x8]
   0x7ff7f2f594d6                  mov    rdx, QWORD PTR [rdx+0x18]
   0x7ff7f2f594da                  mov    QWORD PTR [rbp-0x28], rdx
   0x7ff7f2f594de                  mov    rdi, rax
   0x7ff7f2f594e1                  mov    rax, QWORD PTR [rbp-0x8]
   0x7ff7f2f594e5                  mov    rcx, rax
─────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "ch", stopped 0x7ff7f2f594d2 in ?? (), reason: SIGSEGV
[#1] Id 2, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#2] Id 3, Name: "ch", stopped 0x55555593e345 in Memory::ArenaAllocatorBase<Memory::InPlaceFreeListPolicy, 4ul, false, 0ul>::AllocInternal (), reason: SIGSEGV
[#3] Id 4, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
───────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x7ff7f2f594d2 → mov rdx, QWORD PTR [rax+0x8]
[#1] 0x7fff00000002 → add BYTE PTR [rax], al