Segmentation fault in Jest

[targos]

Version

main

Platform

macOS arm64

Subsystem

No response

What steps will reproduce the bug?

wget https://github.com/tj/commander.js/archive/e6f56c888c96d1339c2b974fee7e6ba4f2e3d218.tar.gz
tar xf e6f56c888c96d1339c2b974fee7e6ba4f2e3d218.tar.gz
cd commander.js-e6f56c888c96d1339c2b974fee7e6ba4f2e3d218
npm install
/path/to/node node_modules/.bin/jest useColor.test.js --runInBand

How often does it reproduce? Is there a required condition?

Always.

What is the expected behavior? Why is that the expected behavior?

Tests should pass

What do you see instead?

Segfault.

Additional information

With a debug build:

Process 23677 stopped
* thread #1, name = 'MainThread', queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x70)
    frame #0: 0x000000010007d5f0 node`node::Realm::isolate(this=0x0000000000000000) const at node_realm-inl.h:46:10
   43  	}
   44
   45  	inline v8::Isolate* Realm::isolate() const {
-> 46  	  return isolate_;
   47  	}
   48
   49  	inline Realm::Kind Realm::kind() const {
Target 0: (node) stopped.
(lldb) bt
* thread #1, name = 'MainThread', queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x70)
  * frame #0: 0x000000010007d5f0 node`node::Realm::isolate(this=0x0000000000000000) const at node_realm-inl.h:46:10
    frame #1: 0x0000000100478d78 node`node::util::DefineLazyPropertiesGetter(name=Local<v8::Name> @ 0x000000016fdfcce8, info=0x000000016fdfcdc0) at node_util.cc:354:29
    frame #2: 0x000000010111481c node`v8::internal::PropertyCallbackArguments::CallAccessorGetter(this=0x000000016fdfcda8, info=<unavailable>, name=Handle<v8::internal::Name> @ x20) at api-arguments-inl.h:436:3 [opt]
    frame #3: 0x0000000101112cf8 node`v8::internal::Object::GetPropertyWithAccessor(it=<unavailable>) at objects.cc:1460:33 [opt]
    frame #4: 0x0000000101111608 node`v8::internal::Object::GetProperty(it=0x000000016fdfcf78, is_global_reference=<unavailable>) at objects.cc:1209:16 [opt]
    frame #5: 0x0000000100fc47dc node`v8::internal::JSReceiver::GetOwnPropertyDescriptor(it=0x000000016fdfcf78, desc=0x000000016fdfd028) at js-objects.cc:1922:22 [opt]
    frame #6: 0x0000000100fbc4b4 node`v8::internal::JSReceiver::GetOwnPropertyDescriptor(isolate=0x0000000128008000, object=Handle<v8::internal::JSReceiver> @ x20, key=Handle<v8::internal::Object> @ x22, desc=0x000000016fdfd028) at js-objects.cc:1819:10 [opt]
    frame #7: 0x0000000101343738 node`v8::internal::Runtime_GetOwnPropertyDescriptorObject(int, unsigned long*, v8::internal::Isolate*) [inlined] v8::internal::__RT_impl_Runtime_GetOwnPropertyDescriptorObject(args=v8::internal::RuntimeArguments @ 0x000000016fdfd050, isolate=0x0000000128008000) at runtime-object.cc:1314:7 [opt]
    frame #8: 0x00000001013436e0 node`v8::internal::Runtime_GetOwnPropertyDescriptorObject(args_length=<unavailable>, args_object=0x000000016fdfd0d8, isolate=0x0000000128008000) at runtime-object.cc:1305:1 [opt]
    frame #9: 0x0000000101f7d974 node`Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit + 84
    frame #10: 0x0000000101f4f954 node`Builtins_ObjectGetOwnPropertyDescriptor + 148
    frame #11: 0x0000000101ecf8d8 node`Builtins_InterpreterEntryTrampoline + 280
    frame #12: 0x0000000101ecf8d8 node`Builtins_InterpreterEntryTrampoline + 280
    frame #13: 0x000000013021f590

[aduh95]

Introduced by #57081