Fix invalid free in TypedArray find method. (#4230)

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com

jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c

@@ -1237,10 +1237,9 @@ ecma_builtin_typedarray_prototype_find_helper (ecma_value_t this_arg, /**< this
     ecma_value_t call_args[] = { element_value, ecma_make_uint32_value (buffer_index), this_arg };
     ecma_value_t call_value = ecma_op_function_call (func_object_p, predicate_this_arg, call_args, 3);
 
-    ecma_free_value (element_value);
-
     if (ECMA_IS_VALUE_ERROR (call_value))
     {
+      ecma_free_value (element_value);
       return call_value;
     }
 
@@ -1254,10 +1253,12 @@ ecma_builtin_typedarray_prototype_find_helper (ecma_value_t this_arg, /**< this
         return element_value;
       }
 
+      ecma_free_value (element_value);
       return ecma_make_uint32_value (buffer_index);
     }
 
     buffer_index++;
+    ecma_free_value (element_value);
   }
 
   return is_find ? ECMA_VALUE_UNDEFINED : ecma_make_integer_value (-1);

tests/jerry/es.next/regression-test-issue-4213.js

@@ -0,0 +1,17 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var arr = new BigInt64Array([39n]);
+
+var result = arr.find(function() { return true; });

tests/test262-esnext-excludelist.xml

@@ -1649,10 +1649,7 @@
   <test id="built-ins/TypedArray/prototype/filter/speciesctor-get-species-returns-throws.js"><reason></reason></test>
   <test id="built-ins/TypedArray/prototype/filter/speciesctor-get-species.js"><reason></reason></test>
   <test id="built-ins/TypedArray/prototype/find/BigInt/detached-buffer.js"><reason></reason></test>
-  <test id="built-ins/TypedArray/prototype/find/BigInt/get-length-ignores-length-prop.js"><reason></reason></test>
-  <test id="built-ins/TypedArray/prototype/find/BigInt/predicate-call-changes-value.js"><reason></reason></test>
   <test id="built-ins/TypedArray/prototype/find/BigInt/predicate-may-detach-buffer.js"><reason></reason></test>
-  <test id="built-ins/TypedArray/prototype/find/BigInt/return-found-value-predicate-result-is-true.js"><reason></reason></test>
   <test id="built-ins/TypedArray/prototype/find/detached-buffer.js"><reason></reason></test>
   <test id="built-ins/TypedArray/prototype/find/predicate-may-detach-buffer.js"><reason></reason></test>
   <test id="built-ins/TypedArray/prototype/findIndex/BigInt/detached-buffer.js"><reason></reason></test>