Crash at v8::Object::GetRealNamedPropertyAttributes

[po6ix]

• Version:
  v14.6.0

• Platform:
  ubuntu 19.04

What steps will reproduce the bug?

const vm = require('vm');

var handler = {
    getOwnPropertyDescriptor: () => {
        return {};
    }
};

const source = `p=6`;

var proxy = new Proxy({}, handler);
const ctx = vm.createContext(proxy);

script = new vm.Script(source);
script.runInContext(ctx);

How often does it reproduce? Is there a required condition?

nothing

What is the expected behavior?

no error

What do you see instead?

crash

attachment core.zip

[addaleax]

Opened https://chromium-review.googlesource.com/c/v8/v8/+/2335057 to address this in V8