Fix memory leak in ecma_op_abstract_relational_compare (#4235)

Fixes #4234.

JerryScript-DCO-1.0-Signed-off-by: Csaba Osztrogonác csaba.osztrogonac@h-lab.eu

jerry-core/ecma/operations/ecma-comparison.c

@@ -391,14 +391,11 @@ ecma_op_abstract_relational_compare (ecma_value_t x, /**< first operand */
       ecma_number_t nx;
       ecma_number_t ny;
 
-      if (ECMA_IS_VALUE_ERROR (ecma_op_to_number (px, &nx)))
+      if (ECMA_IS_VALUE_ERROR (ecma_op_to_number (px, &nx))
+          || ECMA_IS_VALUE_ERROR (ecma_op_to_number (py, &ny)))
       {
-        return ECMA_VALUE_ERROR;
-      }
-
-      if (ECMA_IS_VALUE_ERROR (ecma_op_to_number (py, &ny)))
-      {
-        return ECMA_VALUE_ERROR;
+        ret_value = ECMA_VALUE_ERROR;
+        goto end;
       }
 
       /* b. */
@@ -515,7 +512,8 @@ ecma_op_abstract_relational_compare (ecma_value_t x, /**< first operand */
         ecma_number_t ny;
         if (ECMA_IS_VALUE_ERROR (ecma_op_to_number (py, &ny)))
         {
-          return ECMA_VALUE_ERROR;
+          ret_value = ECMA_VALUE_ERROR;
+          goto end;
         }
 
         if (ecma_number_is_nan (ny))
@@ -552,6 +550,7 @@ ecma_op_abstract_relational_compare (ecma_value_t x, /**< first operand */
     ret_value = ecma_make_boolean_value (is_px_less);
   }
 
+end:
   ecma_free_value (prim_second_converted_value);
   ecma_free_value (prim_first_converted_value);
 

tests/jerry/es.next/regresssion-test-issue-4234.js

@@ -0,0 +1,42 @@
+/* Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+try {
+  1 < Symbol(1)
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+try {
+  Symbol(1) < 1
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+try {
+  1n < Symbol(1)
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+try {
+  Symbol(1) < 1n
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}