BoundFunctions [[Length]] property should be ecma_number_t (#4072)

This patch fixes #4043.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu

jerry-core/ecma/base/ecma-gc.c

@@ -1426,6 +1426,10 @@ ecma_gc_free_object (ecma_object_t *object_p) /**< object to free */
 
       ecma_value_t args_len_or_this = bound_func_p->header.u.bound_function.args_len_or_this;
 
+#if ENABLED (JERRY_ESNEXT)
+      ecma_free_value (bound_func_p->target_length);
+#endif /* ENABLED (JERRY_ESNEXT) */
+
       if (!ecma_is_value_integer_number (args_len_or_this))
       {
         ecma_free_value_if_not_object (args_len_or_this);

jerry-core/ecma/base/ecma-globals.h

@@ -1000,7 +1000,7 @@ typedef struct
 {
   ecma_extended_object_t header; /**< extended object header */
 #if ENABLED (JERRY_ESNEXT)
-  ecma_integer_value_t target_length; /**< length of target function */
+  ecma_value_t target_length; /**< length of target function */
 #endif /* ENABLED (JERRY_ESNEXT) */
 } ecma_bound_function_t;
 

jerry-core/ecma/builtin-objects/ecma-builtin-function-prototype.c

@@ -302,7 +302,7 @@ ecma_builtin_function_prototype_object_bind (ecma_object_t *this_arg_obj_p , /**
     ecma_deref_object (prototype_obj_p);
   }
 
-  ecma_integer_value_t len = 0;
+  ecma_value_t target_length = ecma_make_integer_value (0);
   ecma_string_t *len_string = ecma_get_magic_string (LIT_MAGIC_STRING_LENGTH);
   ecma_property_descriptor_t prop_desc;
   ecma_value_t status = ecma_op_object_get_own_property_descriptor (this_arg_obj_p,
@@ -333,12 +333,12 @@ ecma_builtin_function_prototype_object_bind (ecma_object_t *this_arg_obj_p , /**
     {
       ecma_number_t len_num;
       ecma_op_to_integer (len_value, &len_num);
-      len = (ecma_integer_value_t) len_num;
+      target_length = ecma_make_number_value (len_num);
     }
     ecma_free_value (len_value);
   }
 
-  bound_func_p->target_length = len;
+  bound_func_p->target_length = target_length;
 
   /* 12. */
   ecma_value_t name_value = ecma_op_object_get_by_magic_id (this_arg_obj_p, LIT_MAGIC_STRING_NAME);

jerry-core/ecma/operations/ecma-function-object.c

@@ -1663,7 +1663,7 @@ ecma_op_bound_function_try_to_lazy_instantiate_property (ecma_object_t *object_p
   {
     ecma_bound_function_t *bound_func_p = (ecma_bound_function_t *) object_p;
     ecma_value_t args_len_or_this = bound_func_p->header.u.bound_function.args_len_or_this;
-    ecma_integer_value_t length = 0;
+    ecma_number_t length = 0;
     ecma_integer_value_t args_length = 1;
     uint8_t length_attributes;
 
@@ -1679,7 +1679,7 @@ ecma_op_bound_function_try_to_lazy_instantiate_property (ecma_object_t *object_p
     }
 
     length_attributes = ECMA_PROPERTY_FLAG_CONFIGURABLE;
-    length = bound_func_p->target_length - (args_length - 1);
+    length = ecma_get_number_from_value (bound_func_p->target_length) - (args_length - 1);
 
     /* Set tag bit to represent initialized 'length' property */
     ECMA_SET_FIRST_BIT_TO_POINTER_TAG (bound_func_p->header.u.bound_function.target_function);
@@ -1713,7 +1713,7 @@ ecma_op_bound_function_try_to_lazy_instantiate_property (ecma_object_t *object_p
                                                                                length_attributes,
                                                                                &len_prop_p);
 
-    len_prop_value_p->value = ecma_make_integer_value (length);
+    len_prop_value_p->value = ecma_make_number_value (length);
     return len_prop_p;
   }
 

tests/jerry/es.next/regression-test-issue-4043.js

@@ -0,0 +1,23 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+function f(a, b, c) { }
+
+Object.defineProperty(f, "length", {
+  writable: true,
+  configurable: true,
+  value: 10 ** 42
+});
+
+assert(f.bind().length == 10 ** 42);