Addresses an incomplete fix from 1b0b660

Author: jwalker

quickjs.c

@@ -9901,6 +9901,7 @@ static int set_array_length(JSContext *ctx, JSObject *p, JSValue val,
         if (len < old_len) {
             for(i = len; i < old_len; i++) {
                 JS_FreeValue(ctx, p->u.array.u.values[i]);
+                p->u.array.u.values[i] = JS_UNDEFINED;
             }
             p->u.array.count = len;
         }

tests/fix_set_array_length-uaf.js

@@ -0,0 +1,6 @@
+// Crash — heap-use-after-free (confirmed with ASan)
+const arr = [{a:1}, {b:2}, {c:3}, {d:4}, {e:5}];
+arr.length = 2;   // frees elements 2-4
+arr.length = 5;   // grows length back; count stays at 2
+arr.push({f:6}); // count jumps to 6; elements 2-4 are freed but readable
+print(JSON.stringify(arr[3])); // reads freed memory