After `jit_value_stack_destory()`, the `JitValue` pointed
by `value_list_head` and `value_list_end` are freed and
still keep the value.

So, when `jit_value_stack_push()` is called, for example,
`load_block_params()` after `jit_value_stack_destroy()` in
`handle_op_else()`, `value_stack` will not be treated like
an empty one, and new `JitValue` will be appended to `value_list_end`,
which is a dangling pointer(pointer to the freed `JitValue`).

In my case, the crash will be occured if `value_stack` be destroied
again.