github_mirrors/quickjs
3
0
Fork 1
mirror of https://github.com/bellard/quickjs.git synced 2025-09-27 05:38:45 +03:00
Code Issues Packages Projects Releases Wiki Activity

fixed crash in OP_add_loc if the variable is modified in JS_ToPrimitiveFree()

Browse Source
This commit is contained in:
Fabrice Bellard 2025-08-25 14:50:04 +02:00
parent e1c18befb8
commit 1168c215d1
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
quickjs.c
View File

@ -18646,12 +18646,10 @@ static JSValue JS_CallInternal(JSContext *caller_ctx, JSValueConst func_obj,
*pv = __JS_NewFloat64(ctx, JS_VALUE_GET_FLOAT64(*pv) + *pv = __JS_NewFloat64(ctx, JS_VALUE_GET_FLOAT64(*pv) +
JS_VALUE_GET_FLOAT64(op2)); JS_VALUE_GET_FLOAT64(op2));
sp--; sp--;
} else if (JS_VALUE_GET_TAG(*pv) == JS_TAG_STRING) { } else if (JS_VALUE_GET_TAG(*pv) == JS_TAG_STRING &&
JS_VALUE_GET_TAG(op2) == JS_TAG_STRING) {
sp--; sp--;
sf->cur_pc = pc; sf->cur_pc = pc;
op2 = JS_ToPrimitiveFree(ctx, op2, HINT_NONE);
if (JS_IsException(op2))
goto exception;
if (JS_ConcatStringInPlace(ctx, JS_VALUE_GET_STRING(*pv), op2)) { if (JS_ConcatStringInPlace(ctx, JS_VALUE_GET_STRING(*pv), op2)) {
JS_FreeValue(ctx, op2); JS_FreeValue(ctx, op2);
} else { } else {