Skip to content

Commit ba4e3a4

Browse files
authored
Correct release of spread arguments (#3867)
During the `opfunc_spread_arguments` argument release process the stack pointer was incremented early resulting in a state where one of the arguments was not freed causing a memory leak. JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.usz@partner.samsung.com
1 parent cae6cd0 commit ba4e3a4

File tree

2 files changed

+54
-1
lines changed

2 files changed

+54
-1
lines changed

jerry-core/vm/opcodes.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -471,7 +471,7 @@ opfunc_spread_arguments (ecma_value_t *stack_top_p, /**< pointer to the current
471471
{
472472
for (uint32_t k = i + 1; k < arguments_list_len; k++)
473473
{
474-
ecma_free_value (*(++stack_top_p));
474+
ecma_free_value (*stack_top_p++);
475475
}
476476

477477
ecma_collection_free (buff_p);
Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// Copyright JS Foundation and other contributors, http://js.foundation
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
try {
16+
Object (...1, {});
17+
assert (false);
18+
} catch (ex) {
19+
// expected error: "TypeError: object is not iterable"
20+
assert (ex instanceof TypeError);
21+
}
22+
23+
try {
24+
Object (...1, {}, {});
25+
assert (false);
26+
} catch (ex) {
27+
// expected error: "TypeError: object is not iterable"
28+
assert (ex instanceof TypeError);
29+
}
30+
31+
try {
32+
Object (...1, { "prop": 2 }, 1, { "prop": 2 });
33+
assert (false);
34+
} catch (ex) {
35+
// expected error: "TypeError: object is not iterable"
36+
assert (ex instanceof TypeError);
37+
}
38+
39+
try {
40+
Object (...1, "str");
41+
assert (false);
42+
} catch (ex) {
43+
// expected error: "TypeError: object is not iterable"
44+
assert (ex instanceof TypeError);
45+
}
46+
47+
try {
48+
Object (...[], { "prop": 2 }, 1, { "prop": 2 }, ...1);
49+
assert (false);
50+
} catch (ex) {
51+
// expected error: "TypeError: object is not iterable"
52+
assert (ex instanceof TypeError);
53+
}

0 commit comments

Comments
 (0)