fix crash when add property maybe failed on build arguments

Author: penneryu

quickjs.c

@@ -13571,6 +13571,10 @@ static JSValue js_build_arguments(JSContext *ctx, int argc, JSValue *argv)
     /* add the length field (cannot fail) */
     pr = add_property(ctx, p, JS_ATOM_length,
                       JS_PROP_WRITABLE | JS_PROP_CONFIGURABLE);
+    if (!pr) {
+        JS_FreeValue(ctx, val);
+        return JS_EXCEPTION;
+    }
     pr->u.value = js_int32(argc);
 
     /* initialize the fast array part */
@@ -13620,6 +13624,8 @@ static JSValue js_build_mapped_arguments(JSContext *ctx, int argc,
     /* add the length field (cannot fail) */
     pr = add_property(ctx, p, JS_ATOM_length,
                       JS_PROP_WRITABLE | JS_PROP_CONFIGURABLE);
+    if (!pr)
+        goto fail;
     pr->u.value = js_int32(argc);
 
     for(i = 0; i < arg_count; i++) {