Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed in function gc_mark_string (mjs.c:10678)

[Vancir]

I found an assertion failure while mjs (latest, b1b6eac) executes the PoC on Ubuntu 20.04.

Download the PoC: mjs_assertion-failure_mjs10678.zip

Output

mjs-bin: mjs.c:10678: void gc_mark_string(struct mjs *, mjs_val_t *): Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed.
[1]    1527614 IOT instruction  ./mjs-bin -f 

Steps to reproduce

git clone https://github.com/cesanta/mjs.git
cd mjs
clang -g -O1 -fsanitize=address -fno-omit-frame-pointer -Wno-error -DMJS_MAIN mjs.c -dl -o mjs_asan
./mjs_asan -f PoC