[BUG] qjs: SIGSEGV in find_own_property during backtrace construction

BUG description:

Running qjs under an 8MB memory limit on a JavaScript input causes a segmentation fault in find_own_property() while building an exception backtrace.

The crash occurs through JS_DefineProperty() and build_backtrace(), suggesting that an invalid object shape/property state is reached during error handling.

Steps to Reproduce:

The PoC attachment contains the input file that triggers the crash:

Null_Pointer.zip

COMMAND LINE:

./qjs --memory-limit 8M Null_Pointer

Expected behavior

qjs should handle malformed or adversarial scripts by reporting a script error or exiting cleanly, rather than dereferencing invalid object property state during backtrace construction.

version:

QuickJS version 2026-06-04 Git branch: master commit: https://github.com/bellard/quickjs/commit/04be246001599f5995fa2f2d8c91a0f198d3f34c

OS and version:

Ubuntu 22.04.5 LTS arch: x86_64

Compiler:

gcc 11.4.0 clang 14.0.0

GDB output excerpt:

Program received signal SIGSEGV, Segmentation fault.

#0 find_own_property ( p=0x2398db58, atom=57, ppr=) at quickjs.c:6134 #1 JS_DefineProperty ( ctx=ctx@entry=0x233cd370, this_obj=..., prop=prop@entry=57, val=..., getter=..., setter=..., flags=9987) at quickjs.c:10357 #2 0x00000000004d02dd in JS_DefinePropertyValue (...) at quickjs.c:10674 #3 build_backtrace ( ctx=0x1875a5f <bbMapFb+7633791>, error_obj=..., filename=0x0, line_num=0, col_num=0, backtrace_flags=0) at quickjs.c:7606 #4 JS_CallInternal (...) at quickjs.c:20486 #5 0x0000000000495c21 in JS_CallInternal (...) at quickjs.c:18199 #6 0x0000000000495c21 in JS_CallInternal (...) at quickjs.c:18199 #7 0x0000000000495c21 in JS_CallInternal (...) at quickjs.c:18199 #8 0x0000000000495c21 in JS_CallInternal (...) at quickjs.c:18199 #9 0x0000000000495c21 in JS_CallInternal (...) at quickjs.c:18199 #10 0x0000000000495c21 in JS_CallInternal (...) at quickjs.c:18199 #15 0x0000000000495c21 in JS_CallInternal (...) at quickjs.c:18199

Additional Information:

Crash type: SIGSEGV Crash location: find_own_property() Memory limit: 8M Fully reproducible.