From 435c9cadcfbb135870493006090a1d2988567409 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A9ter=20G=C3=A1l?= <pgal.usz@partner.samsung.com>
Date: Mon, 27 Jul 2020 19:47:55 +0200
Subject: [PATCH] Correctly free descriptors in Object.assign (#4069)

The property descriptors must be free'd during the iteration in the
Object.assign even if the property is not enumerable (or there is no value/getter).

Fixes: #4048

JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.usz@partner.samsung.com
---
 .../builtin-objects/ecma-builtin-object.c     |  3 +-
 .../es.next/regression-test-issue-4048.js     | 69 +++++++++++++++++++
 2 files changed, 71 insertions(+), 1 deletion(-)
 create mode 100644 tests/jerry/es.next/regression-test-issue-4048.js

diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-object.c b/jerry-core/ecma/builtin-objects/ecma-builtin-object.c
index fbcf12543..6bb6b6146 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-object.c
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-object.c
@@ -1116,8 +1116,9 @@ ecma_builtin_object_object_assign (ecma_object_t *target_p, /**< target object *
         }
 
         ecma_free_value (prop_value);
-        ecma_free_property_descriptor (&prop_desc);
       }
+
+      ecma_free_property_descriptor (&prop_desc);
     }
 
     ecma_deref_object (from_obj_p);
diff --git a/tests/jerry/es.next/regression-test-issue-4048.js b/tests/jerry/es.next/regression-test-issue-4048.js
new file mode 100644
index 000000000..2883e3bff
--- /dev/null
+++ b/tests/jerry/es.next/regression-test-issue-4048.js
@@ -0,0 +1,69 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/* Single non-enumerable property leak check with Object.assign, */
+var from = {};
+Object.defineProperty (from, "abc", { enumerable: false, get: function() { return new String ("demo"); }})
+assert ((from.abc + "") === "demo");
+
+var out = Object.assign ({}, from);
+assert (typeof (out.abc) === "undefined");
+
+/* Test with Proxy */
+var called_get = false;
+var called_keys = false;
+var called_desc = false;
+var called_extra_get = false;
+
+var prox = new Proxy (from, {
+  get: function (target, key) {
+    assert (key === "ERR");
+    called_get = true;
+    throw new URIError("ERR");
+  },
+  ownKeys: function (target) {
+    called_keys = true;
+    return ["abc", "ERR"];
+  },
+  getOwnPropertyDescriptor: function(target, key) {
+    if (key === "ERR") {
+      called_desc = true;
+      return { enumerable: true,
+               get: function() {
+                 /* This should never be called! */
+                 called_extra_get = true;
+                 return "ABC";
+               },
+               configurable: true,
+      };
+    }
+    return Reflect.getOwnPropertyDescriptor(target, key);
+  },
+});
+
+try {
+  var prox_out = Object.assign ({}, prox);
+  assert (false);
+} catch (ex) {
+  assert (ex instanceof URIError);
+}
+
+assert (called_keys === true);
+assert (called_desc === true);
+assert (called_get === true);
+
+assert (called_extra_get === false);
+
+/* Original test case from the issue report: test if there is a leak on exit. */
+var result = Object.assign({}, RegExp);