
###### JerryScript revision
2faafa4
###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)
###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```

###### Test case
```
var arr = new Float64Array();
  
arr.reduceRight(function(t) {}, 'Registration');
```
###### Output
```
=================================================================
==31022==ERROR: AddressSanitizer: heap-use-after-free on address 0xf5b00910 at pc 0x56791b61 bp 0xffdffe68 sp 0xffdffe58
READ of size 4 at 0xf5b00910 thread T0
    #0 0x56791b60 in ecma_free_string_list /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:77
    #1 0x56791f4f in ecma_finalize_lit_storage /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:154
    #2 0x56790979 in ecma_finalize /root/jerryscript/jerry-core/ecma/base/ecma-init-finalize.c:103
    #3 0x567b9b1d in jerry_cleanup /root/jerryscript/jerry-core/api/jerry.c:256
    #4 0x567b4a9c in main /root/jerryscript/jerry-main/main-unix.c:324
    #5 0xf778bf20 in __libc_start_main (/lib32/libc.so.6+0x18f20)
    #6 0x566543d0  (/root/jerryscript/build/bin/jerry+0x1d3d0)

0xf5b00910 is located 0 bytes inside of 21-byte region [0xf5b00910,0xf5b00925)
freed by thread T0 here:
    #0 0xf7a4fb94 in __interceptor_free (/usr/lib32/libasan.so.4+0xe5b94)
    #1 0x5670f5d4 in jmem_heap_free_block_internal /root/jerryscript/jerry-core/jmem/jmem-heap.c:478
    #2 0x5670f97f in jmem_heap_free_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:692
    #3 0x5670dca6 in ecma_dealloc_string_buffer /root/jerryscript/jerry-core/ecma/base/ecma-alloc.c:236
    #4 0x567def54 in ecma_destroy_ecma_string /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:936
    #5 0x567dec07 in ecma_deref_ecma_string /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:894
    #6 0x5678a09f in ecma_free_value /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:1126
    #7 0x567bcebe in jerry_release_value /root/jerryscript/jerry-core/api/jerry.c:1859
    #8 0x567b3af5 in main /root/jerryscript/jerry-main/main-unix.c:144
    #9 0xf778bf20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

previously allocated by thread T0 here:
    #0 0xf7a4ff54 in malloc (/usr/lib32/libasan.so.4+0xe5f54)
    #1 0x5670f28c in jmem_heap_alloc /root/jerryscript/jerry-core/jmem/jmem-heap.c:254
    #2 0x5670f36a in jmem_heap_gc_and_alloc_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:291
    #3 0x5670f3fc in jmem_heap_alloc_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:325
    #4 0x5670dc83 in ecma_alloc_string_buffer /root/jerryscript/jerry-core/ecma/base/ecma-alloc.c:222
    #5 0x567db63e in ecma_new_ecma_string_from_utf8_buffer /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:263
    #6 0x567db63e in ecma_new_ecma_string_from_utf8 /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:357
    #7 0x56792004 in ecma_find_or_create_literal_string /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:170
    #8 0x5671beea in parser_post_processing /root/jerryscript/jerry-core/parser/js/js-parser.c:1312
    #9 0x5672043a in parser_parse_source /root/jerryscript/jerry-core/parser/js/js-parser.c:2019
    #10 0x5672490a in parser_parse_script /root/jerryscript/jerry-core/parser/js/js-parser.c:2799
    #11 0x567ba359 in jerry_parse /root/jerryscript/jerry-core/api/jerry.c:459
    #12 0x567b3859 in main /root/jerryscript/jerry-main/main-unix.c:112
    #13 0xf778bf20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

SUMMARY: AddressSanitizer: heap-use-after-free /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:77 in ecma_free_string_list
Shadow bytes around the buggy address:
  0x3eb600d0: fa fa fa fa fa fa fa fa fa fa fd fd fd fa fa fa
  0x3eb600e0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x3eb600f0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x3eb60100: fd fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa
  0x3eb60110: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
=>0x3eb60120: fa fa[fd]fd fd fa fa fa fd fd fd fd fa fa fd fd
  0x3eb60130: fd fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa
  0x3eb60140: fd fd fd fd fa fa fd fd fd fa fa fa fd fd fd fa
  0x3eb60150: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x3eb60160: fd fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x3eb60170: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==31022==ABORTING
```

Credits: Found by chong from OWL337.
heap-use-after-free in ecma_free_string_list
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : heap-use-after-free in ecma_free_string_list
Issue date:

--- start body ---

###### JerryScript revision
2faafa4
###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)
###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```

###### Test case
```
var arr = new Float64Array();
  
arr.reduceRight(function(t) {}, 'Registration');
```
###### Output
```
=================================================================
==31022==ERROR: AddressSanitizer: heap-use-after-free on address 0xf5b00910 at pc 0x56791b61 bp 0xffdffe68 sp 0xffdffe58
READ of size 4 at 0xf5b00910 thread T0
    #0 0x56791b60 in ecma_free_string_list /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:77
    #1 0x56791f4f in ecma_finalize_lit_storage /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:154
    #2 0x56790979 in ecma_finalize /root/jerryscript/jerry-core/ecma/base/ecma-init-finalize.c:103
    #3 0x567b9b1d in jerry_cleanup /root/jerryscript/jerry-core/api/jerry.c:256
    #4 0x567b4a9c in main /root/jerryscript/jerry-main/main-unix.c:324
    #5 0xf778bf20 in __libc_start_main (/lib32/libc.so.6+0x18f20)
    #6 0x566543d0  (/root/jerryscript/build/bin/jerry+0x1d3d0)

0xf5b00910 is located 0 bytes inside of 21-byte region [0xf5b00910,0xf5b00925)
freed by thread T0 here:
    #0 0xf7a4fb94 in __interceptor_free (/usr/lib32/libasan.so.4+0xe5b94)
    #1 0x5670f5d4 in jmem_heap_free_block_internal /root/jerryscript/jerry-core/jmem/jmem-heap.c:478
    #2 0x5670f97f in jmem_heap_free_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:692
    #3 0x5670dca6 in ecma_dealloc_string_buffer /root/jerryscript/jerry-core/ecma/base/ecma-alloc.c:236
    #4 0x567def54 in ecma_destroy_ecma_string /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:936
    #5 0x567dec07 in ecma_deref_ecma_string /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:894
    #6 0x5678a09f in ecma_free_value /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:1126
    #7 0x567bcebe in jerry_release_value /root/jerryscript/jerry-core/api/jerry.c:1859
    #8 0x567b3af5 in main /root/jerryscript/jerry-main/main-unix.c:144
    #9 0xf778bf20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

previously allocated by thread T0 here:
    #0 0xf7a4ff54 in malloc (/usr/lib32/libasan.so.4+0xe5f54)
    #1 0x5670f28c in jmem_heap_alloc /root/jerryscript/jerry-core/jmem/jmem-heap.c:254
    #2 0x5670f36a in jmem_heap_gc_and_alloc_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:291
    #3 0x5670f3fc in jmem_heap_alloc_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:325
    #4 0x5670dc83 in ecma_alloc_string_buffer /root/jerryscript/jerry-core/ecma/base/ecma-alloc.c:222
    #5 0x567db63e in ecma_new_ecma_string_from_utf8_buffer /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:263
    #6 0x567db63e in ecma_new_ecma_string_from_utf8 /root/jerryscript/jerry-core/ecma/base/ecma-helpers-string.c:357
    #7 0x56792004 in ecma_find_or_create_literal_string /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:170
    #8 0x5671beea in parser_post_processing /root/jerryscript/jerry-core/parser/js/js-parser.c:1312
    #9 0x5672043a in parser_parse_source /root/jerryscript/jerry-core/parser/js/js-parser.c:2019
    #10 0x5672490a in parser_parse_script /root/jerryscript/jerry-core/parser/js/js-parser.c:2799
    #11 0x567ba359 in jerry_parse /root/jerryscript/jerry-core/api/jerry.c:459
    #12 0x567b3859 in main /root/jerryscript/jerry-main/main-unix.c:112
    #13 0xf778bf20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

SUMMARY: AddressSanitizer: heap-use-after-free /root/jerryscript/jerry-core/ecma/base/ecma-literal-storage.c:77 in ecma_free_string_list
Shadow bytes around the buggy address:
  0x3eb600d0: fa fa fa fa fa fa fa fa fa fa fd fd fd fa fa fa
  0x3eb600e0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x3eb600f0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x3eb60100: fd fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa
  0x3eb60110: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
=>0x3eb60120: fa fa[fd]fd fd fa fa fa fd fd fd fd fa fa fd fd
  0x3eb60130: fd fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa
  0x3eb60140: fd fd fd fd fa fa fd fd fd fa fa fa fd fd fd fa
  0x3eb60150: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x3eb60160: fd fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x3eb60170: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==31022==ABORTING
```

Credits: Found by chong from OWL337.
--- end body ---
