Null Pointer Dereference in build_for_in_iterator

[anbu1024]

QuickJS version:
2788d71

Test case:

function foo() {
    
    function Bar() {
    }
    
    class Apple extends Bar {
        constructor(a) {
            (() => {
            	for (const i in this) {}
                eval(a);
                return 0;
            })();
        }
    }
    const y = new Apple();
    return y;
}

let x = new Promise(foo);

Error:
crashed due to null pointer deference,

In function JSValue build_for_in_iterator(JSContext *ctx, JSValue obj), line 15129, the

p = JS_VALUE_GET_OBJ(obj);

returns 0.

[dchest]

I believe this is caused by eval appearing in the function causing the function to close over this, but not keeping the is_lexical status here :

https://github.com/bellard/quickjs/blob/2788d71e823b522b178db3b3660ce93689534e6d/quickjs.c#L30312-L30320

                vd = &fd->vars[i];
                /* do not close top level last result */
                if (vd->scope_level == 0 &&
                    vd->var_name != JS_ATOM__ret_ &&
                    vd->var_name != JS_ATOM_NULL) {
                    get_closure_var(ctx, s, fd,
                                    FALSE, i, vd->var_name, FALSE, FALSE,
                                    JS_VAR_NORMAL);
                }

is_lexical is added in order to emit opcode that checks that variable is initialized:

https://github.com/bellard/quickjs/blob/master/quickjs.c#L29514-L29515

without it, accessing an uninitialized variable is done without checking, so it crashes.

Possible fix: add vd->var_name != JS_ATOM_this to the above construction inside add_eval_variables to skip adding this (since it's already added earlier), but I'm not sure if it's correct.