Abort when using `JS_NewObjectFromStr` after `JS_NewObject`

[andrjohns]

A little edge-case crash that I ran into with JS_NewObjectFromStr:

#include "quickjs.h"

int main(void) {
  JSRuntime *rt = JS_NewRuntime();
  JSContext *ctx = JS_NewContext(rt);

  JSValue obj = JS_NewObject(ctx);

  const char *props[] = {"a", "b", "c"};
  JSValue vals[] = {JS_NewInt32(ctx, 1), JS_NewInt32(ctx, 2), JS_NewInt32(ctx, 3)};
  JSValue built = JS_NewObjectFromStr(ctx, 3, props, vals);

  JS_FreeValue(ctx, obj);
  JS_FreeValue(ctx, built);
  JS_FreeContext(ctx);
  JS_FreeRuntime(rt);
  return 0;
}

Crashes with:

andrew@HomeLinux:~/Git/quickjs-ng$ ./reprex 
reprex: /home/andrew/Git/quickjs-ng/quickjs.c:5193: JS_NewObjectFrom: Assertion `sh->header.ref_count == 1' failed.
Aborted                    (core dumped) ./reprex

[saghul]

At a quick glance the assert feels bogus, there is indeed another object with the same shape there.

[bnoordhuis]

It's there for a reason, you can't remove it without introducing a shape leak. I suspect a backport changed something in an incompatible way.