Repository: nginx/njs (c)

Issue:
AddressSanitizer: SEGV src/njs_function.c:399 in njs_function_lambda_frame
### Describe the bug

AddressSanitizer: SEGV src/njs_function.c:399 in njs_function_lambda_frame ==4237==ABORTING- [ok ] 

The bug is reproducible with the latest version of njs.
- [ ok] I minimized the code and NGINX configuration to the smallest
possible to reproduce the issue.

### To reproduce

Steps to reproduce the behavior:

- JS script
```js
// Your JS code here
const v1 = new Uint32Array(Uint32Array, Uint32Array);
const v2 = v1.values();
Promise.any.call(v2);

```

Debug/Crash logs:
ASAN
```
AddressSanitizer:DEADLYSIGNAL ================================================================= ==4237==ERROR: 
AddressSanitizer: 
SEGV on unknown address 0x000000000028 (pc 0x564807d815bf bp 0x7ffcc01f5b00 sp 0x7ffcc01f5aa0 T0) 
==4237==The signal is caused by a READ memory access. 
==4237==Hint: address points to the zero page. 
#0 0x564807d815bf in njs_function_lambda_frame src/njs_function.c:399 
#1 0x564807d831e0 in njs_function_frame src/njs_function.h:154 
#2 0x564807d831e0 in njs_function_call2 src/njs_function.c:510 
#3 0x564807daed15 in njs_promise_new_capability src/njs_promise.c:368 
#4 0x564807daf4ea in njs_promise_all src/njs_promise.c:1180 
#5 0x564807d83124 in njs_function_native_call src/njs_function.c:647 
#6 0x564807d83124 in njs_function_frame_invoke src/njs_function.c:683 
#7 0x564807d831ca in njs_function_call2 src/njs_function.c:515 
#8 0x564807d83246 in njs_function_call src/njs_function.h:164 
#9 0x564807d83246 in njs_function_prototype_call src/njs_function.c:1236 
#10 0x564807d83124 in njs_function_native_call src/njs_function.c:647 
#11 0x564807d83124 in njs_function_frame_invoke src/njs_function.c:683 
#12 0x564807cc9118 in njs_vmcode_interpreter src/njs_vmcode.c:1451 
#13 0x564807cae647 in njs_vm_start src/njs_vm.c:664 
#14 0x564807c9a501 in njs_engine_njs_eval external/njs_shell.c:1387 
#15 0x564807c97596 in njs_process_script external/njs_shell.c:3528 
#16 0x564807c9e033 in njs_process_file external/njs_shell.c:3500 
#17 0x564807c9e033 in njs_main external/njs_shell.c:458 
#18 0x564807c9e033 in main external/njs_shell.c:488 
#19 0x7fdbcacb5d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 
#20 0x7fdbcacb5e3f in __libc_start_main_impl ../csu/libc-start.c:392 
#21 0x564807c97424 in _start (/home/fuzzer/njs/build/njs+0x50424) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV src/njs_function.c:399 in njs_function_lambda_frame ==4237==ABORTING

```




or put the code in a [gist](https://gist.github.com/) and link it here.
- NGINX configuration if applicable
```
# Your NGINX configuration here
```
or put the configuration in a [gist](https://gist.github.com/) and link it here.
- NGINX logs if applicable
```
# Your NGINX logs here
```
or post the full log to a [gist](https://gist.github.com/) and link it here.
- Output of the `nginx -V` command if applicable.
- Exact steps to reproduce the behavior

### Expected behavior

A clear and concise description of what you expected to happen.

### Your environment

- Version of njs or specific commit
- Version of NGINX if applicable
- List of other enabled nginx modules if applicable
- OS: Ubuntu 18.04

### Additional context

Add any other context about the problem here.



Discussion:

Patch:
diff --git a/src/njs_object.c b/src/njs_object.c
--- a/src/njs_object.c
+++ b/src/njs_object.c
@@ -2231,6 +2231,10 @@ njs_object_prototype_create_constructor(njs_vm_t *vm, njs_object_prop_t *prop,
 
 found:
 
+    if (njs_flathsh_is_empty(&vm->constructors[index].object.shared_hash)) {
+        index = NJS_OBJ_TYPE_OBJECT;
+    }
+
     njs_set_function(&constructor, &njs_vm_ctor(vm, index));
     setval = &constructor;
 


Test patch:
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -7450,6 +7450,9 @@ static njs_unit_test_t  njs_test[] =
               "[i.next(), i.next(), i.next(), i.next()].map((x) => x.value)"),
       njs_str("1,2,3,") },
 
+    { njs_str("[].values().constructor()"),
+      njs_str("[object Object]") },
+
     { njs_str("var a = [], i = a.values();"
               "a.push(1); a.push(2); a.push(3);"
               "[i.next(), i.next(), i.next(), i.next()].map((x) => x.value)"),