Closed
Description
Version
16.15.0
Platform
Linux zanardance 5.14.0-1036-oem #40-Ubuntu SMP Mon May 9 09:15:08 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
macOS has the same problem
Subsystem
No response
What steps will reproduce the bug?
Use this code:
'use strict';
while (true) {
const tagKeys = Object.keys({ k: 'key' });
// const tagKeys = [ 1 ];
tagKeys[0];
}And run with --untrusted-code-mitigations:
$ node --untrusted-code-mitigations foo.jsHow often does it reproduce? Is there a required condition?
Every time.
What is the expected behavior?
No response
What do you see instead?
Segmentation fault.
Additional information
No response