From 16d0e83b6418b2f310659d160a0a9302b25ca171 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1niel=20B=C3=A1tyai?= <dbatyai@inf.u-szeged.hu>
Date: Tue, 26 Nov 2019 08:21:33 +0100
Subject: [PATCH] Fix adding fast arrays as keys to a weak container (#3362)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #3359.

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai@inf.u-szeged.hu
---
 jerry-core/ecma/operations/ecma-container-object.c | 5 +++++
 tests/jerry/es2015/weakmap.js                      | 2 ++
 tests/jerry/es2015/weakset.js                      | 2 ++
 3 files changed, 9 insertions(+)

diff --git a/jerry-core/ecma/operations/ecma-container-object.c b/jerry-core/ecma/operations/ecma-container-object.c
index b6aa20ac2..0ebf2f2eb 100644
--- a/jerry-core/ecma/operations/ecma-container-object.c
+++ b/jerry-core/ecma/operations/ecma-container-object.c
@@ -411,6 +411,11 @@ static void
 ecma_op_container_set_weak (ecma_object_t *const key_p, /**< key object */
                             ecma_extended_object_t *const container_p) /**< container */
 {
+  if (JERRY_UNLIKELY (ecma_op_object_is_fast_array (key_p)))
+  {
+    ecma_fast_array_convert_to_normal (key_p);
+  }
+
   ecma_string_t *weak_refs_string_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_WEAK_REFS);
   ecma_property_t *property_p = ecma_find_named_property (key_p, weak_refs_string_p);
   ecma_collection_t *refs_p;
diff --git a/tests/jerry/es2015/weakmap.js b/tests/jerry/es2015/weakmap.js
index ff4e7286a..3539722b1 100644
--- a/tests/jerry/es2015/weakmap.js
+++ b/tests/jerry/es2015/weakmap.js
@@ -135,6 +135,8 @@ try {
   assert (e instanceof TypeError);
 }
 
+m1.set([], []);
+
 assert (WeakMap.prototype.toString() === "[object WeakMap]");
 
 WeakMap.prototype.set = function () { throw "abrupt set" };
diff --git a/tests/jerry/es2015/weakset.js b/tests/jerry/es2015/weakset.js
index adb9bacab..040b53307 100644
--- a/tests/jerry/es2015/weakset.js
+++ b/tests/jerry/es2015/weakset.js
@@ -119,6 +119,8 @@ try {
   assert (e instanceof TypeError);
 }
 
+m1.add([]);
+
 assert (WeakSet.prototype.toString() === "[object WeakSet]");
 
 WeakSet.prototype.add = function () { throw "abrupt add" };