From 351acdf545f846db09627b022189e7ad14111252 Mon Sep 17 00:00:00 2001 From: szilagyiadam <51477572+szilagyiadam@users.noreply.github.com> Date: Tue, 11 Jun 2019 17:42:14 +0200 Subject: [PATCH] Add missing release value call for opfunc_addition (#2899) Right_value wasn't correctly freed in case of an error. Fixes #2894 Fixes #2897 Co-authored-by: Tibor Dusnoki JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi aszilagy@inf.u-szeged.hu --- jerry-core/vm/opcodes-ecma-arithmetics.c | 1 + tests/jerry/fail/regression-test-issue-2894.js | 16 ++++++++++++++++ tests/jerry/fail/regression-test-issue-2897.js | 16 ++++++++++++++++ 3 files changed, 33 insertions(+) create mode 100644 tests/jerry/fail/regression-test-issue-2894.js create mode 100644 tests/jerry/fail/regression-test-issue-2897.js diff --git a/jerry-core/vm/opcodes-ecma-arithmetics.c b/jerry-core/vm/opcodes-ecma-arithmetics.c index 00852e303..96412bd0a 100644 --- a/jerry-core/vm/opcodes-ecma-arithmetics.c +++ b/jerry-core/vm/opcodes-ecma-arithmetics.c @@ -145,6 +145,7 @@ opfunc_addition (ecma_value_t left_value, /**< left value */ if (ECMA_IS_VALUE_ERROR (str_right_value)) { + ecma_free_value (right_value); ecma_deref_ecma_string (string1_p); return str_right_value; } diff --git a/tests/jerry/fail/regression-test-issue-2894.js b/tests/jerry/fail/regression-test-issue-2894.js new file mode 100644 index 000000000..a8ea9a84f --- /dev/null +++ b/tests/jerry/fail/regression-test-issue-2894.js @@ -0,0 +1,16 @@ +// Copyright JS Foundation and other contributors, http://js.foundation +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +Array.prototype.unshift(Object(Symbol())); +Array.prototype.reduce(function(p_0, p_1) { return p_0 + p_1}, ""); diff --git a/tests/jerry/fail/regression-test-issue-2897.js b/tests/jerry/fail/regression-test-issue-2897.js new file mode 100644 index 000000000..ec24207a0 --- /dev/null +++ b/tests/jerry/fail/regression-test-issue-2897.js @@ -0,0 +1,16 @@ +// Copyright JS Foundation and other contributors, http://js.foundation +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +object = { valueOf: function ( ) { return Symbol ( "foo" ) } }; +assert("" + object);