diff --git a/jerry-core/ecma/base/ecma-gc.c b/jerry-core/ecma/base/ecma-gc.c index aef59a5b21..068458917c 100644 --- a/jerry-core/ecma/base/ecma-gc.c +++ b/jerry-core/ecma/base/ecma-gc.c @@ -254,6 +254,8 @@ ecma_gc_mark_container_object (ecma_object_t *object_p) /**< object */ ecma_map_object_t *map_object_p = (ecma_map_object_t *) object_p; ecma_object_t *internal_obj_p = ecma_get_object_from_value (map_object_p->header.u.class_prop.u.value); + ecma_gc_set_object_visited (internal_obj_p); + ecma_property_header_t *prop_iter_p = ecma_get_property_list (internal_obj_p); if (prop_iter_p != NULL && prop_iter_p->types[0] == ECMA_PROPERTY_TYPE_HASHMAP) @@ -719,7 +721,6 @@ ecma_gc_free_object (ecma_object_t *object_p) /**< object to free */ #if ENABLED (JERRY_ES2015_BUILTIN_SET) case LIT_MAGIC_STRING_SET_UL: { - ecma_op_container_clear_map ((ecma_map_object_t *) object_p); ecma_dealloc_extended_object (object_p, sizeof (ecma_map_object_t)); return; } @@ -727,7 +728,6 @@ ecma_gc_free_object (ecma_object_t *object_p) /**< object to free */ #if ENABLED (JERRY_ES2015_BUILTIN_MAP) case LIT_MAGIC_STRING_MAP_UL: { - ecma_op_container_clear_map ((ecma_map_object_t *) object_p); ecma_dealloc_extended_object (object_p, sizeof (ecma_map_object_t)); return; } diff --git a/jerry-core/ecma/operations/ecma-container-object.c b/jerry-core/ecma/operations/ecma-container-object.c index 1bc94fb807..831bec1b48 100644 --- a/jerry-core/ecma/operations/ecma-container-object.c +++ b/jerry-core/ecma/operations/ecma-container-object.c @@ -33,24 +33,6 @@ * @{ */ -/** - * Creates an empty object for the map/set object's internal slot. - * - * Note: The created object is not registered to the GC. - * - * @return ecma value of the created object - */ -static ecma_value_t -ecma_op_container_create_internal_object (void) -{ - ecma_object_t *internal_object_p = ecma_alloc_object (); - internal_object_p->type_flags_refs = (ECMA_OBJECT_TYPE_GENERAL | ECMA_OBJECT_FLAG_EXTENSIBLE | ECMA_OBJECT_REF_ONE); - internal_object_p->property_list_or_bound_object_cp = JMEM_CP_NULL; - internal_object_p->prototype_or_outer_reference_cp = JMEM_CP_NULL; - - return ecma_make_object_value (internal_object_p); -} /* ecma_op_container_create_internal_object */ - /** * Handle calling [[Construct]] of built-in map/set like objects * @@ -64,15 +46,19 @@ ecma_op_container_create (const ecma_value_t *arguments_list_p, /**< arguments l { JERRY_ASSERT (arguments_list_len == 0 || arguments_list_p != NULL); + ecma_object_t *internal_object_p = ecma_create_object (NULL, 0, ECMA_OBJECT_TYPE_GENERAL); + ecma_object_t *object_p = ecma_create_object (ecma_builtin_get (proto_id), sizeof (ecma_map_object_t), ECMA_OBJECT_TYPE_CLASS); ecma_map_object_t *map_obj_p = (ecma_map_object_t *) object_p; map_obj_p->header.u.class_prop.class_id = (uint16_t) lit_id; - map_obj_p->header.u.class_prop.u.value = ecma_op_container_create_internal_object (); + map_obj_p->header.u.class_prop.u.value = ecma_make_object_value (internal_object_p); map_obj_p->size = 0; + ecma_deref_object (internal_object_p); + ecma_value_t set_value = ecma_make_object_value (object_p); #if ENABLED (JERRY_ES2015_BUILTIN_SYMBOL) @@ -433,54 +419,6 @@ ecma_op_container_set (ecma_value_t this_arg, /**< this argument */ return this_arg; } /* ecma_op_container_set */ -/** - * Low-level function to clear all items from a map/set - */ -void -ecma_op_container_clear_map (ecma_map_object_t *map_object_p) /**< map object */ -{ - ecma_object_t *object_p = ecma_get_object_from_value (map_object_p->header.u.class_prop.u.value); - - JERRY_ASSERT (object_p->type_flags_refs >= ECMA_OBJECT_REF_ONE); - - ecma_property_header_t *prop_iter_p = ecma_get_property_list (object_p); - - if (prop_iter_p != NULL && prop_iter_p->types[0] == ECMA_PROPERTY_TYPE_HASHMAP) - { - ecma_property_hashmap_free (object_p); - prop_iter_p = ecma_get_property_list (object_p); - } - - while (prop_iter_p != NULL) - { - JERRY_ASSERT (ECMA_PROPERTY_IS_PROPERTY_PAIR (prop_iter_p)); - - /* Both cannot be deleted. */ - JERRY_ASSERT (prop_iter_p->types[0] != ECMA_PROPERTY_TYPE_DELETED - || prop_iter_p->types[1] != ECMA_PROPERTY_TYPE_DELETED); - - ecma_property_pair_t *prop_pair_p = (ecma_property_pair_t *) prop_iter_p; - - for (int i = 0; i < ECMA_PROPERTY_PAIR_ITEM_COUNT; i++) - { - ecma_property_t *property_p = (ecma_property_t *) (prop_iter_p->types + i); - jmem_cpointer_t name_cp = prop_pair_p->names_cp[i]; - - if (prop_iter_p->types[i] != ECMA_PROPERTY_TYPE_DELETED) - { - ecma_free_property (object_p, name_cp, property_p); - } - } - - prop_iter_p = ECMA_GET_POINTER (ecma_property_header_t, - prop_iter_p->next_property_cp); - - ecma_dealloc_property_pair (prop_pair_p); - } - - ecma_dealloc_object (object_p); -} /* ecma_op_container_clear_map */ - /** * The generic map/set prototype object's 'forEach' routine * @@ -592,11 +530,12 @@ ecma_op_container_clear (ecma_value_t this_arg, /**< this argument */ return ECMA_VALUE_ERROR; } - ecma_op_container_clear_map (map_object_p); - - map_object_p->header.u.class_prop.u.value = ecma_op_container_create_internal_object (); + ecma_object_t *internal_object_p = ecma_create_object (NULL, 0, ECMA_OBJECT_TYPE_GENERAL); + map_object_p->header.u.class_prop.u.value = ecma_make_object_value (internal_object_p); map_object_p->size = 0; + ecma_deref_object (internal_object_p); + return ECMA_VALUE_UNDEFINED; } /* ecma_op_container_clear */ diff --git a/jerry-core/ecma/operations/ecma-container-object.h b/jerry-core/ecma/operations/ecma-container-object.h index ed8519f2ab..6959d2b9d4 100644 --- a/jerry-core/ecma/operations/ecma-container-object.h +++ b/jerry-core/ecma/operations/ecma-container-object.h @@ -37,7 +37,7 @@ ecma_value_t ecma_op_container_foreach (ecma_value_t this_arg, ecma_value_t pred ecma_value_t ecma_op_container_has (ecma_value_t this_arg, ecma_value_t key_arg, lit_magic_string_id_t lit_id); ecma_value_t ecma_op_container_set (ecma_value_t this_arg, ecma_value_t key_arg, ecma_value_t value_arg, lit_magic_string_id_t lit_id); -void ecma_op_container_clear_map (ecma_map_object_t *map_object_p); + ecma_value_t ecma_op_container_clear (ecma_value_t this_arg, lit_magic_string_id_t lit_id); ecma_value_t ecma_op_container_delete (ecma_value_t this_arg, ecma_value_t key_arg, lit_magic_string_id_t lit_id); ecma_value_t ecma_op_container_create_iterator (ecma_value_t this_arg, uint8_t type, lit_magic_string_id_t lit_id, diff --git a/tests/jerry/es2015/regression-test-issue-2951.js b/tests/jerry/es2015/regression-test-issue-2951.js new file mode 100644 index 0000000000..67e9156e4f --- /dev/null +++ b/tests/jerry/es2015/regression-test-issue-2951.js @@ -0,0 +1,16 @@ +// Copyright JS Foundation and other contributors, http://js.foundation +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// To trigger the assertion the engine must be compiled with --system allocator=ON and --mem-stress-test=ON +m = new Map([]);