heap-use-after-free src/jsiObj.c:672 in jsi_ObjNewObj

[applepiep1e]

jsish reversion
42c694c
master

Build platform
Ubuntu 22.04.3 LTS (Linux 5.19.17 x86_64)

Build steps

export CFLAGS="-g -fsanitize=address"
export CXXFLAGS="-g -fsanitize=address"
./jsish poc.js

Test case
poc.js

var a = [0];
for (var i in a) {
    a[0]  instanceof Number;
}

Output

=================================================================
Program received signal SIGSEGV, Segmentation fault.
0x000060c000018340 in ?? ()
(gdb) bt
#0  0x000060c000018340 in ?? ()
#1  0x00005555557b35e8 in jsiEvalCodeSub (ps=0x60b000000300, opcodes=0x604000019ad0, scope=0x603000001960, currentScope=0x603000000190, _this=0x603000000190, vret=0x6030000039a0) at src/jsiEval.c:1661
#2  0x00005555557bb0f9 in jsi_evalcode (ps=0x60b000000300, func=0x0, opcodes=0x604000019ad0, scope=0x603000001960, fargs=0x603000000190, _this=0x603000000190, vret=0x7fffffff2320, fi=0x604000018cd0)
    at src/jsiEval.c:2231
#3  0x00005555557bfcc1 in jsi_evalStrFile (interp=0x62e000000400, path=0x6030000066d0, 
    str=0x61b000000080 "// Minimizing A7B57196-A29E-4000-ABAB-E5AF4EABEF31\n//var v0 = [1.739443105518256e+308,-713.3648177786276,0.8768754063668446,6.099556170034531e+307,0.5908393917271753,0.0,0.0510954124208447,-608.256023"..., flags=73, level=0) at src/jsiEval.c:2684
#4  0x00005555557c06bd in Jsi_EvalFile (interp=0x62e000000400, fname=0x6030000066d0, flags=73) at src/jsiEval.c:2733
#5  0x000055555560ffda in Jsi_Main (opts=0x7fffffffd3f0) at src/jsiInterp.c:936
#6  0x000055555587f857 in jsi_main (argc=2, argv=0x7fffffffdde8) at src/main.c:47
#7  0x000055555587f969 in main (argc=2, argv=0x7fffffffdde8) at src/main.c:55

Fix:
You drops a break statement after "Jsi_LogBug("next: toq not a iter\n");" on in src/jsiEval.c: 1645.