parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure.
cpe:2.3:a:jerryscript:jerryscript:2.2.0:*:*:*:*:*:*:*
88EBD351-0E34-480A-906A-603AC3920FBF
OR
###### JerryScript revision
https://github.com/jerryscript-project/jerryscript/commit/6cd309b5252d15f3e3e6481c72a4d8fa7f9557a9

###### Build platform
Ubuntu 20.04 LTS (Linux 5.4.0-31-generic x86_64)

###### Build steps

```sh
python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g \
--error-messages=on --debug --compile-flag=-g --strip=off --logging=on \
 --compile-flag=-fsanitize=address --stack-limit=15
```

###### Test case

```
function main() {
var v2 = [13.37,13.37];
var v4 = [1337,1337,1337];
var v5 = [parseFloat,parseFloat,v2];
var v8 = new Float64Array(63797);
var v10 = "d".constructor;
var v12 = [1337,1337,1337,1337];
var v13 = [];
var v14 = {constructor:v12,a:v13};
var v15 = v14.a;
var v18 = 0;
v15.toString = v10;
var v20 = new Int16Array();
do {
    var v25 = String.fromCharCode(1337,128);
    try {
        var v26 = eval(v25);
    } catch(v27) {
    }
    var v28 = v18 + 1;
    v18 = v28;
    v13[v28] = v20;
} while (v18 < 1337);
}
main();
```

###### Output

```
$ build/bin/jerry test.js
ICE: Assertion 'context_p->error == PARSER_ERR_NO_ERROR' failed at /tmp/jerryscript/jerry-core/parser/js/js-scanner.c(scanner_scan_all):3196.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted (core dumped)
```
Assertion 'context_p->error == PARSER_ERR_NO_ERROR' failed at jerry-core/parser/js/js-scanner.c(scanner_scan_all):3196
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : Assertion 'context_p->error == PARSER_ERR_NO_ERROR' failed at jerry-core/parser/js/js-scanner.c(scanner_scan_all):3196
Issue date:

--- start body ---
###### JerryScript revision
https://github.com/jerryscript-project/jerryscript/commit/6cd309b5252d15f3e3e6481c72a4d8fa7f9557a9

###### Build platform
Ubuntu 20.04 LTS (Linux 5.4.0-31-generic x86_64)

###### Build steps

```sh
python tools/build.py --profile=es2015-subset --lto=off --compile-flag=-g \
--error-messages=on --debug --compile-flag=-g --strip=off --logging=on \
 --compile-flag=-fsanitize=address --stack-limit=15
```

###### Test case

```
function main() {
var v2 = [13.37,13.37];
var v4 = [1337,1337,1337];
var v5 = [parseFloat,parseFloat,v2];
var v8 = new Float64Array(63797);
var v10 = "d".constructor;
var v12 = [1337,1337,1337,1337];
var v13 = [];
var v14 = {constructor:v12,a:v13};
var v15 = v14.a;
var v18 = 0;
v15.toString = v10;
var v20 = new Int16Array();
do {
    var v25 = String.fromCharCode(1337,128);
    try {
        var v26 = eval(v25);
    } catch(v27) {
    }
    var v28 = v18 + 1;
    v18 = v28;
    v13[v28] = v20;
} while (v18 < 1337);
}
main();
```

###### Output

```
$ build/bin/jerry test.js
ICE: Assertion 'context_p->error == PARSER_ERR_NO_ERROR' failed at /tmp/jerryscript/jerry-core/parser/js/js-scanner.c(scanner_scan_all):3196.
Error: ERR_FAILED_INTERNAL_ASSERTION
Aborted (core dumped)
```
--- end body ---

comments :
--- start comments ---

--- end comments ---