diff --git a/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c b/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c index eac549790..0d128931a 100644 --- a/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c +++ b/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c @@ -1294,6 +1294,7 @@ ecma_builtin_typedarray_prototype_fill (ecma_value_t this_arg, /**< this argumen info.length, &begin_index_uint32))) { + ecma_free_value (value_to_set); return ECMA_VALUE_ERROR; } @@ -1307,6 +1308,7 @@ ecma_builtin_typedarray_prototype_fill (ecma_value_t this_arg, /**< this argumen info.length, &end_index_uint32))) { + ecma_free_value (value_to_set); return ECMA_VALUE_ERROR; } } diff --git a/tests/jerry/es.next/typedArray-fill.js b/tests/jerry/es.next/typedArray-fill.js index ed9203cf9..a8509be28 100644 --- a/tests/jerry/es.next/typedArray-fill.js +++ b/tests/jerry/es.next/typedArray-fill.js @@ -112,3 +112,24 @@ assert(k.fill(-5n, 3, 5).toString() === '0,0,0,-5,-5'); var l = new BigUint64Array([1n, 2n, 3n, 4n, 5n]); assert(l.fill(-18446744073709551614n, 3, 5).toString() === '1,2,3,2,2'); assert(l.fill(18446744073709551614n, 4).toString() === '1,2,3,2,18446744073709551614'); + +var invalid = { + valueOf: function() { + throw new Error(); + } +}; + +var m = new BigInt64Array(); +try { + m.fill(1n, invalid); + assert(false) +} catch (e) { + assert(e instanceof Error); +} + +try { + m.fill(1n, 0, invalid); + assert(false) +} catch (e) { + assert(e instanceof Error); +}