[cp-20]

Why

evalCode(src, file, { type: "module", compileOnly: true }) reads an uninitialized pointer in QTS_Eval.

module is only assigned on the evaluate path. With compileOnly, JS_Eval returns the compiled module (JS_TAG_MODULE), which is not an exception and has the module flag set, so it falls through to the namespace conversion: the result is freed and JS_GetModuleNamespace(ctx, module) is called with garbage.

const h = vm.unwrapResult(
  vm.evalCode("export const x = 1", "m.js", { type: "module", compileOnly: true }),
)
vm.typeof(h) // "number" on 0.32.0; "unknown" (compiled code) for type: "global"

What

Return compile-only results before the module namespace/promise handling, the same way global compile-only code is already returned. The caller owns and disposes the handle.

Notes

Ran quickjs.test.ts for quickjs release/debug (sync + asyncify) and quickjs-ng release (sync + asyncify). quickjs-ng debug and the packaging/browser/example jobs were not run locally.