YourWishes/jerryscript
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix invalid free in TypedArray find method. (#4230)

Browse Source 
JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com
This commit is contained in:
Zoltan Herczeg
2020-09-28 10:48:14 +02:00
committed by GitHub
parent c4388e2c19
commit 32de38198a
3 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c
+3 -2
View File
@@ -1237,10 +1237,9 @@ ecma_builtin_typedarray_prototype_find_helper (ecma_value_t this_arg, /**< this
ecma_value_t call_args[] = { element_value, ecma_make_uint32_value (buffer_index), this_arg };
ecma_value_t call_value = ecma_op_function_call (func_object_p, predicate_this_arg, call_args, 3);
ecma_free_value (element_value);
if (ECMA_IS_VALUE_ERROR (call_value))
{
ecma_free_value (element_value);
return call_value;
}
@@ -1254,10 +1253,12 @@ ecma_builtin_typedarray_prototype_find_helper (ecma_value_t this_arg, /**< this
return element_value;
}
ecma_free_value (element_value);
return ecma_make_uint32_value (buffer_index);
}
buffer_index++;
ecma_free_value (element_value);
}
return is_find ? ECMA_VALUE_UNDEFINED : ecma_make_integer_value (-1);
tests/jerry/es.next/regression-test-issue-4213.js
+17
View File
@@ -0,0 +1,17 @@
// Copyright JS Foundation and other contributors, http://js.foundation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
var arr = new BigInt64Array([39n]);
var result = arr.find(function() { return true; });
tests/test262-esnext-excludelist.xml
-3
View File
@@ -1649,10 +1649,7 @@
<test id="built-ins/TypedArray/prototype/filter/speciesctor-get-species-returns-throws.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/filter/speciesctor-get-species.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/find/BigInt/detached-buffer.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/find/BigInt/get-length-ignores-length-prop.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/find/BigInt/predicate-call-changes-value.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/find/BigInt/predicate-may-detach-buffer.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/find/BigInt/return-found-value-predicate-result-is-true.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/find/detached-buffer.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/find/predicate-may-detach-buffer.js"><reason></reason></test>
<test id="built-ins/TypedArray/prototype/findIndex/BigInt/detached-buffer.js"><reason></reason></test>