
###### JerryScript revision
2faafa4

###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)

###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```

###### Test case
```
var arr = new Int32Array(0);
arr.reduceRight(Math.asinh, 0.00001);
```

###### Output
```

=================================================================
==11298==ERROR: AddressSanitizer: heap-use-after-free on address 0xf5d00650 at pc 0x566dfe24 bp 0xff8a9ca8 sp 0xff8a9c98
READ of size 4 at 0xf5d00650 thread T0
    #0 0x566dfe23 in jmem_pools_collect_empty /root/jerryscript/jerry-core/jmem/jmem-poolman.c:165
    #1 0x566df9b0 in jmem_pools_finalize /root/jerryscript/jerry-core/jmem/jmem-poolman.c:44
    #2 0x566def76 in jmem_finalize /root/jerryscript/jerry-core/jmem/jmem-allocator.c:161
    #3 0x56789dc0 in jerry_cleanup /root/jerryscript/jerry-core/api/jerry.c:272
    #4 0x56784a9c in main /root/jerryscript/jerry-main/main-unix.c:324
    #5 0xf7785f20 in __libc_start_main (/lib32/libc.so.6+0x18f20)
    #6 0x566243d0  (/root/jerryscript/build/bin/jerry+0x1d3d0)

0xf5d00650 is located 0 bytes inside of 8-byte region [0xf5d00650,0xf5d00658)
freed by thread T0 here:
    #0 0xf7a49b94 in __interceptor_free (/usr/lib32/libasan.so.4+0xe5b94)
    #1 0x566df5d4 in jmem_heap_free_block_internal /root/jerryscript/jerry-core/jmem/jmem-heap.c:478
    #2 0x566dfe38 in jmem_pools_collect_empty /root/jerryscript/jerry-core/jmem/jmem-poolman.c:168
    #3 0x566df9b0 in jmem_pools_finalize /root/jerryscript/jerry-core/jmem/jmem-poolman.c:44
    #4 0x566def76 in jmem_finalize /root/jerryscript/jerry-core/jmem/jmem-allocator.c:161
    #5 0x56789dc0 in jerry_cleanup /root/jerryscript/jerry-core/api/jerry.c:272
    #6 0x56784a9c in main /root/jerryscript/jerry-main/main-unix.c:324
    #7 0xf7785f20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

previously allocated by thread T0 here:
    #0 0xf7a49f54 in malloc (/usr/lib32/libasan.so.4+0xe5f54)
    #1 0x566df28c in jmem_heap_alloc /root/jerryscript/jerry-core/jmem/jmem-heap.c:254
    #2 0x566df36a in jmem_heap_gc_and_alloc_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:291
    #3 0x566df3da in jmem_heap_alloc_block_internal /root/jerryscript/jerry-core/jmem/jmem-heap.c:310
    #4 0x566dfb31 in jmem_pools_alloc /root/jerryscript/jerry-core/jmem/jmem-poolman.c:85
    #5 0x566ddafa in ecma_alloc_number /root/jerryscript/jerry-core/ecma/base/ecma-alloc.c:57
    #6 0x567b7c4b in ecma_create_float_number.lto_priv.938 /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:515
    #7 0x567b9080 in ecma_copy_value /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:891
    #8 0x567b93ea in ecma_fast_copy_value /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:944
    #9 0x566c4da6 in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1115
    #10 0x566dd48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #11 0x566ddad3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060
    #12 0x566c1ef5 in vm_run_global /root/jerryscript/jerry-core/vm/vm.c:350
    #13 0x5678a7a9 in jerry_run /root/jerryscript/jerry-core/api/jerry.c:608
    #14 0x5678398c in main /root/jerryscript/jerry-main/main-unix.c:123
    #15 0xf7785f20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

SUMMARY: AddressSanitizer: heap-use-after-free /root/jerryscript/jerry-core/jmem/jmem-poolman.c:165 in jmem_pools_collect_empty
Shadow bytes around the buggy address:
  0x3eba0070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba0080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba0090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba00a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba00b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x3eba00c0: fa fa fa fa fa fa fa fa fa fa[fd]fa fa fa fd fd
  0x3eba00d0: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fd
  0x3eba00e0: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
  0x3eba00f0: fa fa fd fd fa fa 00 00 fa fa fa fa fa fa fa fa
  0x3eba0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11298==ABORTING

```

Credits: Found by chong from OWL337.
heap-use-after-free in  jmem_pools_collect_empty
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title : heap-use-after-free in  jmem_pools_collect_empty
Issue date:

--- start body ---

###### JerryScript revision
2faafa4

###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)

###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```

###### Test case
```
var arr = new Int32Array(0);
arr.reduceRight(Math.asinh, 0.00001);
```

###### Output
```

=================================================================
==11298==ERROR: AddressSanitizer: heap-use-after-free on address 0xf5d00650 at pc 0x566dfe24 bp 0xff8a9ca8 sp 0xff8a9c98
READ of size 4 at 0xf5d00650 thread T0
    #0 0x566dfe23 in jmem_pools_collect_empty /root/jerryscript/jerry-core/jmem/jmem-poolman.c:165
    #1 0x566df9b0 in jmem_pools_finalize /root/jerryscript/jerry-core/jmem/jmem-poolman.c:44
    #2 0x566def76 in jmem_finalize /root/jerryscript/jerry-core/jmem/jmem-allocator.c:161
    #3 0x56789dc0 in jerry_cleanup /root/jerryscript/jerry-core/api/jerry.c:272
    #4 0x56784a9c in main /root/jerryscript/jerry-main/main-unix.c:324
    #5 0xf7785f20 in __libc_start_main (/lib32/libc.so.6+0x18f20)
    #6 0x566243d0  (/root/jerryscript/build/bin/jerry+0x1d3d0)

0xf5d00650 is located 0 bytes inside of 8-byte region [0xf5d00650,0xf5d00658)
freed by thread T0 here:
    #0 0xf7a49b94 in __interceptor_free (/usr/lib32/libasan.so.4+0xe5b94)
    #1 0x566df5d4 in jmem_heap_free_block_internal /root/jerryscript/jerry-core/jmem/jmem-heap.c:478
    #2 0x566dfe38 in jmem_pools_collect_empty /root/jerryscript/jerry-core/jmem/jmem-poolman.c:168
    #3 0x566df9b0 in jmem_pools_finalize /root/jerryscript/jerry-core/jmem/jmem-poolman.c:44
    #4 0x566def76 in jmem_finalize /root/jerryscript/jerry-core/jmem/jmem-allocator.c:161
    #5 0x56789dc0 in jerry_cleanup /root/jerryscript/jerry-core/api/jerry.c:272
    #6 0x56784a9c in main /root/jerryscript/jerry-main/main-unix.c:324
    #7 0xf7785f20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

previously allocated by thread T0 here:
    #0 0xf7a49f54 in malloc (/usr/lib32/libasan.so.4+0xe5f54)
    #1 0x566df28c in jmem_heap_alloc /root/jerryscript/jerry-core/jmem/jmem-heap.c:254
    #2 0x566df36a in jmem_heap_gc_and_alloc_block /root/jerryscript/jerry-core/jmem/jmem-heap.c:291
    #3 0x566df3da in jmem_heap_alloc_block_internal /root/jerryscript/jerry-core/jmem/jmem-heap.c:310
    #4 0x566dfb31 in jmem_pools_alloc /root/jerryscript/jerry-core/jmem/jmem-poolman.c:85
    #5 0x566ddafa in ecma_alloc_number /root/jerryscript/jerry-core/ecma/base/ecma-alloc.c:57
    #6 0x567b7c4b in ecma_create_float_number.lto_priv.938 /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:515
    #7 0x567b9080 in ecma_copy_value /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:891
    #8 0x567b93ea in ecma_fast_copy_value /root/jerryscript/jerry-core/ecma/base/ecma-helpers-value.c:944
    #9 0x566c4da6 in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1115
    #10 0x566dd48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #11 0x566ddad3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060
    #12 0x566c1ef5 in vm_run_global /root/jerryscript/jerry-core/vm/vm.c:350
    #13 0x5678a7a9 in jerry_run /root/jerryscript/jerry-core/api/jerry.c:608
    #14 0x5678398c in main /root/jerryscript/jerry-main/main-unix.c:123
    #15 0xf7785f20 in __libc_start_main (/lib32/libc.so.6+0x18f20)

SUMMARY: AddressSanitizer: heap-use-after-free /root/jerryscript/jerry-core/jmem/jmem-poolman.c:165 in jmem_pools_collect_empty
Shadow bytes around the buggy address:
  0x3eba0070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba0080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba0090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba00a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba00b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x3eba00c0: fa fa fa fa fa fa fa fa fa fa[fd]fa fa fa fd fd
  0x3eba00d0: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fd
  0x3eba00e0: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
  0x3eba00f0: fa fa fd fd fa fa 00 00 fa fa fa fa fa fa fa fa
  0x3eba0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3eba0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11298==ABORTING

```

Credits: Found by chong from OWL337.
--- end body ---
