Container object's internal object must be allocated firstly

jerry-core/ecma/base/ecma-gc.c

@@ -254,6 +254,8 @@ ecma_gc_mark_container_object (ecma_object_t *object_p) /**< object */
  ecma_map_object_t *map_object_p = (ecma_map_object_t *) object_p;
  ecma_object_t *internal_obj_p = ecma_get_object_from_value (map_object_p->header.u.class_prop.u.value);
 
+ ecma_gc_set_object_visited (internal_obj_p);
+
  ecma_property_header_t *prop_iter_p = ecma_get_property_list (internal_obj_p);
 
  if (prop_iter_p != NULL && prop_iter_p->types[0] == ECMA_PROPERTY_TYPE_HASHMAP)
@@ -719,15 +721,13 @@ ecma_gc_free_object (ecma_object_t *object_p) /**< object to free */
 #if ENABLED (JERRY_ES2015_BUILTIN_SET)
  case LIT_MAGIC_STRING_SET_UL:
  {
- ecma_op_container_clear_map ((ecma_map_object_t *) object_p);
  ecma_dealloc_extended_object (object_p, sizeof (ecma_map_object_t));
  return;
  }
 #endif /* ENABLED (JERRY_ES2015_BUILTIN_SET) */
 #if ENABLED (JERRY_ES2015_BUILTIN_MAP)
  case LIT_MAGIC_STRING_MAP_UL:
  {
- ecma_op_container_clear_map ((ecma_map_object_t *) object_p);
  ecma_dealloc_extended_object (object_p, sizeof (ecma_map_object_t));
  return;
  }

jerry-core/ecma/operations/ecma-container-object.c

@@ -33,24 +33,6 @@
  * @{
  */
 
-/**
- * Creates an empty object for the map/set object's internal slot.
- *
- * Note: The created object is not registered to the GC.
- *
- * @return ecma value of the created object
- */
-static ecma_value_t
-ecma_op_container_create_internal_object (void)
-{
- ecma_object_t *internal_object_p = ecma_alloc_object ();
- internal_object_p->type_flags_refs = (ECMA_OBJECT_TYPE_GENERAL | ECMA_OBJECT_FLAG_EXTENSIBLE | ECMA_OBJECT_REF_ONE);
- internal_object_p->property_list_or_bound_object_cp = JMEM_CP_NULL;
- internal_object_p->prototype_or_outer_reference_cp = JMEM_CP_NULL;
-
- return ecma_make_object_value (internal_object_p);
-} /* ecma_op_container_create_internal_object */
-
 /**
  * Handle calling [[Construct]] of built-in map/set like objects
  *
@@ -64,15 +46,19 @@ ecma_op_container_create (const ecma_value_t *arguments_list_p, /**< arguments l
 {
  JERRY_ASSERT (arguments_list_len == 0 || arguments_list_p != NULL);
 
+ ecma_object_t *internal_object_p = ecma_create_object (NULL, 0, ECMA_OBJECT_TYPE_GENERAL);
+
  ecma_object_t *object_p = ecma_create_object (ecma_builtin_get (proto_id),
  sizeof (ecma_map_object_t),
  ECMA_OBJECT_TYPE_CLASS);
 
  ecma_map_object_t *map_obj_p = (ecma_map_object_t *) object_p;
  map_obj_p->header.u.class_prop.class_id = (uint16_t) lit_id;
- map_obj_p->header.u.class_prop.u.value = ecma_op_container_create_internal_object ();
+ map_obj_p->header.u.class_prop.u.value = ecma_make_object_value (internal_object_p);
  map_obj_p->size = 0;
 
+ ecma_deref_object (internal_object_p);
+
  ecma_value_t set_value = ecma_make_object_value (object_p);
 
 #if ENABLED (JERRY_ES2015_BUILTIN_SYMBOL)
@@ -433,54 +419,6 @@ ecma_op_container_set (ecma_value_t this_arg, /**< this argument */
  return this_arg;
 } /* ecma_op_container_set */
 
-/**
- * Low-level function to clear all items from a map/set
- */
-void
-ecma_op_container_clear_map (ecma_map_object_t *map_object_p) /**< map object */
-{
- ecma_object_t *object_p = ecma_get_object_from_value (map_object_p->header.u.class_prop.u.value);
-
- JERRY_ASSERT (object_p->type_flags_refs >= ECMA_OBJECT_REF_ONE);
-
- ecma_property_header_t *prop_iter_p = ecma_get_property_list (object_p);
-
- if (prop_iter_p != NULL && prop_iter_p->types[0] == ECMA_PROPERTY_TYPE_HASHMAP)
- {
- ecma_property_hashmap_free (object_p);
- prop_iter_p = ecma_get_property_list (object_p);
- }
-
- while (prop_iter_p != NULL)
- {
- JERRY_ASSERT (ECMA_PROPERTY_IS_PROPERTY_PAIR (prop_iter_p));
-
- /* Both cannot be deleted. */
- JERRY_ASSERT (prop_iter_p->types[0] != ECMA_PROPERTY_TYPE_DELETED
- || prop_iter_p->types[1] != ECMA_PROPERTY_TYPE_DELETED);
-
- ecma_property_pair_t *prop_pair_p = (ecma_property_pair_t *) prop_iter_p;
-
- for (int i = 0; i < ECMA_PROPERTY_PAIR_ITEM_COUNT; i++)
- {
- ecma_property_t *property_p = (ecma_property_t *) (prop_iter_p->types + i);
- jmem_cpointer_t name_cp = prop_pair_p->names_cp[i];
-
- if (prop_iter_p->types[i] != ECMA_PROPERTY_TYPE_DELETED)
- {
- ecma_free_property (object_p, name_cp, property_p);
- }
- }
-
- prop_iter_p = ECMA_GET_POINTER (ecma_property_header_t,
- prop_iter_p->next_property_cp);
-
- ecma_dealloc_property_pair (prop_pair_p);
- }
-
- ecma_dealloc_object (object_p);
-} /* ecma_op_container_clear_map */
-
 /**
  * The generic map/set prototype object's 'forEach' routine
  *
@@ -592,11 +530,12 @@ ecma_op_container_clear (ecma_value_t this_arg, /**< this argument */
  return ECMA_VALUE_ERROR;
  }
 
- ecma_op_container_clear_map (map_object_p);
-
- map_object_p->header.u.class_prop.u.value = ecma_op_container_create_internal_object ();
+ ecma_object_t *internal_object_p = ecma_create_object (NULL, 0, ECMA_OBJECT_TYPE_GENERAL);
+ map_object_p->header.u.class_prop.u.value = ecma_make_object_value (internal_object_p);
  map_object_p->size = 0;
 
+ ecma_deref_object (internal_object_p);
+
  return ECMA_VALUE_UNDEFINED;
 } /* ecma_op_container_clear */
 

jerry-core/ecma/operations/ecma-container-object.h

@@ -37,7 +37,7 @@ ecma_value_t ecma_op_container_foreach (ecma_value_t this_arg, ecma_value_t pred
 ecma_value_t ecma_op_container_has (ecma_value_t this_arg, ecma_value_t key_arg, lit_magic_string_id_t lit_id);
 ecma_value_t ecma_op_container_set (ecma_value_t this_arg, ecma_value_t key_arg, ecma_value_t value_arg,
  lit_magic_string_id_t lit_id);
-void ecma_op_container_clear_map (ecma_map_object_t *map_object_p);
+
 ecma_value_t ecma_op_container_clear (ecma_value_t this_arg, lit_magic_string_id_t lit_id);
 ecma_value_t ecma_op_container_delete (ecma_value_t this_arg, ecma_value_t key_arg, lit_magic_string_id_t lit_id);
 ecma_value_t ecma_op_container_create_iterator (ecma_value_t this_arg, uint8_t type, lit_magic_string_id_t lit_id,

tests/jerry/es2015/regression-test-issue-2951.js

@@ -0,0 +1,16 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// To trigger the assertion the engine must be compiled with --system allocator=ON and --mem-stress-test=ON
+m = new Map([]);