fix array free

source/quickjs.c

@@ -682,7 +682,8 @@ typedef struct JSArray {
     uint32_t len;            /* current length */
     uint32_t cap;            /* allocated capacity */
     JSValue *values;         /* array of values */
-    int stone;
+    uint8_t stone : 1;
+    uint8_t free_mark : 1;   /* only used when freeing arrays with cycles */
 } JSArray;
 
 typedef struct JSRecord {
@@ -5053,13 +5054,26 @@ static void free_array(JSRuntime *rt, JSArray *arr)
 {
     assert(arr->header.gc_obj_type == JS_GC_OBJ_TYPE_ARRAY);
 
+    arr->free_mark = 1; /* used to tell the array is invalid when
+                           freeing cycles */
+
     uint32_t i;
     for (i = 0; i < arr->len; i++) {
         JS_FreeValueRT(rt, arr->values[i]);
     }
     js_free_rt(rt, arr->values);
+
+    /* fail safe */
+    arr->values = NULL;
+    arr->len = 0;
+    arr->cap = 0;
+
     remove_gc_object(&arr->header);
-    js_free_rt(rt, arr);
+    /* free if no strong refs, else queue for zero-ref processing */
+    if (arr->header.ref_count == 0)
+        js_free_rt(rt, arr);
+    else
+        list_add_tail(&arr->header.link, &rt->gc_zero_ref_count_list);
 }
 
 static int js_intrinsic_array_ensure_capacity(JSContext *ctx, JSArray *arr, uint32_t min_cap)