Shifting array element down in the tree must be finished even if an error occurs

Fixes #1671

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu

jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c

@@ -1113,16 +1113,16 @@ ecma_builtin_array_prototype_object_array_to_heap_helper (ecma_value_t array[],
     }
   }
 
+  /*
+   * Loop ended, either current child does not exist, or is less than swap.
+   * This means that 'swap' should be placed in the parent node.
+   */
+  int parent = (child - 1) / 2;
+  JERRY_ASSERT (parent >= 0 && parent <= right);
+  array[parent] = swap;
+
   if (ecma_is_value_empty (ret_value))
   {
-    /*
-     * Loop ended, either current child does not exist, or is less than swap.
-     * This means that 'swap' should be placed in the parent node.
-     */
-    int parent = (child - 1) / 2;
-    JERRY_ASSERT (parent >= 0 && parent <= right);
-    array[parent] = swap;
-
     ret_value = ecma_make_simple_value (ECMA_SIMPLE_VALUE_UNDEFINED);
   }
 

tests/jerry/fail/regression-test-issue-1671.js

@@ -0,0 +1,16 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+Array.prototype.push("A", "B", 0, 1)
+Array.prototype.sort(JSON.parse)