void jspReplaceWithOrAddToRoot(JsVar *dst, JsVar *src) {
  /* If we're assigning to this and we don't have a parent,
   * add it to the symbol table root */
  if (!jsvGetRefs(dst) && jsvIsName(dst)) {
    if (!jsvIsArrayBufferName(dst) && !jsvIsNewChild(dst))
      jsvAddName(execInfo.root, dst);
  }
  jspReplaceWith(dst, src);
}
The software reads data past the end, or before the beginning, of the intended buffer.