From a43186db415ab220a3750bf3ca6703cecdcd4e85 Mon Sep 17 00:00:00 2001
From: Zoltan Herczeg <zherczeg.u-szeged@partner.samsung.com>
Date: Fri, 3 Feb 2017 11:43:36 +0100
Subject: [PATCH] Stack data should be freed for do-while statements after the
 expression is parsed. (#1558)

Fixes #1550.

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com
---
 jerry-core/parser/js/js-parser-statm.c         | 18 +++++++++++++-----
 .../jerry/fail/1/regression-test-issue-1550.js | 15 +++++++++++++++
 2 files changed, 28 insertions(+), 5 deletions(-)
 create mode 100644 tests/jerry/fail/1/regression-test-issue-1550.js

diff --git a/jerry-core/parser/js/js-parser-statm.c b/jerry-core/parser/js/js-parser-statm.c
index 7bbe8162c..a27616b41 100644
--- a/jerry-core/parser/js/js-parser-statm.c
+++ b/jerry-core/parser/js/js-parser-statm.c
@@ -560,7 +560,6 @@ parser_parse_with_statement_end (parser_context_t *context_p) /**< context */
 static void
 parser_parse_do_while_statement_end (parser_context_t *context_p) /**< context */
 {
-  parser_do_while_statement_t do_while_statement;
   parser_loop_statement_t loop;
 
   JERRY_ASSERT (context_p->stack_top_uint8 == PARSER_STATEMENT_DO_WHILE);
@@ -570,10 +569,11 @@ parser_parse_do_while_statement_end (parser_context_t *context_p) /**< context *
     parser_raise_error (context_p, PARSER_ERR_WHILE_EXPECTED);
   }
 
-  parser_stack_pop_uint8 (context_p);
-  parser_stack_pop (context_p, &loop, sizeof (parser_loop_statement_t));
-  parser_stack_pop (context_p, &do_while_statement, sizeof (parser_do_while_statement_t));
-  parser_stack_iterator_init (context_p, &context_p->last_statement);
+  parser_stack_iterator_t iterator;
+  parser_stack_iterator_init (context_p, &iterator);
+
+  parser_stack_iterator_skip (&iterator, 1);
+  parser_stack_iterator_read (&iterator, &loop, sizeof (parser_loop_statement_t));
 
   parser_set_continues_to_current_position (context_p, loop.branch_list_p);
 
@@ -592,6 +592,11 @@ parser_parse_do_while_statement_end (parser_context_t *context_p) /**< context *
       context_p->last_cbc_opcode = PARSER_CBC_UNAVAILABLE;
       opcode = CBC_JUMP_BACKWARD;
     }
+
+    parser_do_while_statement_t do_while_statement;
+    parser_stack_iterator_skip (&iterator, sizeof (parser_loop_statement_t));
+    parser_stack_iterator_read (&iterator, &do_while_statement, sizeof (parser_do_while_statement_t));
+
     parser_emit_cbc_backward_branch (context_p, opcode, do_while_statement.start_offset);
   }
   else
@@ -599,6 +604,9 @@ parser_parse_do_while_statement_end (parser_context_t *context_p) /**< context *
     context_p->last_cbc_opcode = PARSER_CBC_UNAVAILABLE;
   }
 
+  parser_stack_pop (context_p, NULL, sizeof (parser_do_while_statement_t) + sizeof (parser_loop_statement_t) + 1);
+  parser_stack_iterator_init (context_p, &context_p->last_statement);
+
   parser_set_breaks_to_current_position (context_p, loop.branch_list_p);
 } /* parser_parse_do_while_statement_end */
 
diff --git a/tests/jerry/fail/1/regression-test-issue-1550.js b/tests/jerry/fail/1/regression-test-issue-1550.js
new file mode 100644
index 000000000..2af0a001a
--- /dev/null
+++ b/tests/jerry/fail/1/regression-test-issue-1550.js
@@ -0,0 +1,15 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+do break; while a