Segmentation Fault using embedded properties in "on" functions

[JeremyGrieshop]

The following onGetObject function is contrived, simply to demonstrate the problem without adding complication to the issue:

const x = {};
const y = property_get(x, "y", {});

if (is_nullish(property_get(y, "z", null))) {
    y.z = {};
}

return null;

The code path is simple enough; however, multiple calls to get_object() through afwfcgi will result in a situation where the property z off the object y will "remember" it's value from a previous invocation, even after that value (an object) is freed. I believe the issue is that after the embedded object is released from its pool, the reference to it (property z) still exists and points to it.

Here's how to reproduce:

1. Create a simple model /afw/models/_AdaptiveModel_/xyz.json:

{
    "objectTypes": {
        "Crash": {
            "onGetObject": "const x = {};\nconst y = property_get(x, \"y\", {});\n\nif (is_nullish(property_get(y, \"z\", null))) {\n    y.z = {};\n}\n\nreturn null;"
        }
    },
    "modelId": "xyz"
}

2. Create a model adapter service to use it, /afw/config/_AdaptiveServiceConf_/adapter-xyz.json:

{
    "startup": "immediate",
    "serviceId": "adapter-xyz",
    "conf": {
        "adapterId": "xyz",
        "adapterType": "model",
        "type": "adapter",
        "description": "test crash",
        "modelLocationAdapterId": "models",
        "modelId": "xyz",
        "mappedAdapterId": "files"
    }
}

3. I used the VSCode Task Start: valgrind afwfcgi gdb server and then started the Debug: valgrind afwfcgi under the vscode debugger menu.

4. Using Fiddle, execute the following to trigger the onGetObject code:

get_object_with_uri(anyURI("/xyz/Crash/x"));

The first time, it should return Not found as expected. The second time executing it through Fiddle, the residual pointer will cause a crash.