From 035e5a27faecd65eb394fdf59baeef643f87f6bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?P=C3=A9ter=20G=C3=A1l?= Date: Tue, 15 Dec 2020 11:18:14 +0100 Subject: [PATCH] Correctly release wrapper object in JSON stringify (#4361) When an error occurs accessing a property during JSON stringify call the wrapper object is not freed at the correct place. JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.usz@partner.samsung.com --- jerry-core/ecma/builtin-objects/ecma-builtin-json.c | 1 + tests/jerry/es.next/json-stringify.js | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-json.c b/jerry-core/ecma/builtin-objects/ecma-builtin-json.c index 05f0317cf..8be7c8bd6 100644 --- a/jerry-core/ecma/builtin-objects/ecma-builtin-json.c +++ b/jerry-core/ecma/builtin-objects/ecma-builtin-json.c @@ -1268,6 +1268,7 @@ ecma_builtin_json_serialize_property (ecma_json_stringify_context_t *context_p, if (ECMA_IS_VALUE_ERROR (to_json)) { + ecma_free_value (value); return to_json; } diff --git a/tests/jerry/es.next/json-stringify.js b/tests/jerry/es.next/json-stringify.js index 70f1d29d8..b7a312317 100644 --- a/tests/jerry/es.next/json-stringify.js +++ b/tests/jerry/es.next/json-stringify.js @@ -51,3 +51,14 @@ try { assert(JSON.stringify("ab𬄕c") === '"ab𬄕\\u001fc"'); assert(JSON.stringify("ab\uDC01cd") === '"ab\\udc01c\\u001fd"'); assert(JSON.stringify("ab\uDC01cd\uD8331e") === '"ab\\udc01c\\u001fd\\ud8331e"'); + +// Test case where the proxy is already revoked +var handle = Proxy.revocable([], {}); +handle.revoke(); + +try { + JSON.stringify(handle.proxy); + assert(false); +} catch (ex) { + assert(ex instanceof TypeError); +}