diff --git a/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c b/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c index 16b9d14b7..736150ab3 100644 --- a/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c +++ b/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c @@ -27,6 +27,7 @@ #include "ecma-globals.h" #include "ecma-helpers.h" #include "ecma-iterator-object.h" +#include "ecma-number-object.h" #include "ecma-objects.h" #include "ecma-try-catch-macro.h" #include "ecma-typedarray-object.h" @@ -1985,13 +1986,11 @@ ecma_builtin_typedarray_prototype_to_locale_string_helper (ecma_object_t *this_o ecma_number_t element_num = ecma_get_typedarray_element (typedarray_buffer_p + index, class_id); ecma_value_t element_value = ecma_make_number_value (element_num); - ecma_value_t element_obj = ecma_op_to_object (element_value); + ecma_value_t element_obj = ecma_op_create_number_object (element_value); - if (ECMA_IS_VALUE_ERROR (element_obj)) - { - ecma_free_value (element_value); - return element_obj; - } + ecma_free_value (element_value); + + JERRY_ASSERT (!ECMA_IS_VALUE_ERROR (element_obj)); ecma_object_t *element_obj_p = ecma_get_object_from_value (element_obj); @@ -2000,7 +1999,6 @@ ecma_builtin_typedarray_prototype_to_locale_string_helper (ecma_object_t *this_o if (ECMA_IS_VALUE_ERROR (func_value)) { - ecma_free_value (element_value); ecma_deref_object (element_obj_p); return func_value; } @@ -2017,12 +2015,12 @@ ecma_builtin_typedarray_prototype_to_locale_string_helper (ecma_object_t *this_o if (ECMA_IS_VALUE_ERROR (call_value)) { - ecma_free_value (element_value); ecma_deref_object (element_obj_p); return call_value; } ret_value = ecma_op_to_string (call_value); + ecma_free_value (call_value); } else { @@ -2031,7 +2029,6 @@ ecma_builtin_typedarray_prototype_to_locale_string_helper (ecma_object_t *this_o } ecma_deref_object (element_obj_p); - ecma_free_value (element_value); return ret_value; } /* ecma_builtin_typedarray_prototype_to_locale_string_helper */ @@ -2078,7 +2075,7 @@ ecma_builtin_typedarray_prototype_to_locale_string (ecma_value_t this_arg) /**< if (ECMA_IS_VALUE_ERROR (next_element)) { - ecma_free_value (first_element); + ecma_deref_ecma_string (return_string_p); return next_element; } @@ -2087,8 +2084,6 @@ ecma_builtin_typedarray_prototype_to_locale_string (ecma_value_t this_arg) /**< ecma_deref_ecma_string (next_element_p); } - ecma_free_value (first_element); - return ecma_make_string_value (return_string_p); } /* ecma_builtin_typedarray_prototype_to_locale_string */ diff --git a/tests/jerry/es2015/regression-test-issue-3162.js b/tests/jerry/es2015/regression-test-issue-3162.js new file mode 100644 index 000000000..dc80c0fef --- /dev/null +++ b/tests/jerry/es2015/regression-test-issue-3162.js @@ -0,0 +1,19 @@ +// Copyright JS Foundation and other contributors, http://js.foundation +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +try { v0 = this.toString( )} catch ( $ ) { } +try { v1 = this.toLocaleString( ).localeCompare( )} catch ( $ ) { } +try { var v14 = Int8Array.from(((Array)(v0.length))) } catch ( $ ) { } +try { v14(v14.fill(v1)) } catch ( $ ) { } +try { v0(v14.toLocaleString( )) } catch ( $ ) { }