Array.prototype.reduceRight() fix

JerryScript-DCO-1.0-Signed-off-by: Laszlo Vidacs [email protected]

Author: lvidacs

jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.cpp

@@ -2147,12 +2147,10 @@ ecma_builtin_array_prototype_object_reduce_right (ecma_value_t this_arg, /**< th
   }
   else
   {
-    ecma_number_t *num_p = ecma_alloc_number ();
     ecma_object_t *func_object_p;
 
     JERRY_ASSERT (ecma_is_value_object (arg1));
     func_object_p = ecma_get_object_from_value (arg1);
-    ecma_value_t accumulator = ecma_make_simple_value (ECMA_SIMPLE_VALUE_UNDEFINED);
 
     /* 5 */
     if (len_number == ECMA_NUMBER_ZERO && ecma_is_value_undefined (arg2))
@@ -2161,6 +2159,9 @@ ecma_builtin_array_prototype_object_reduce_right (ecma_value_t this_arg, /**< th
     }
     else
     {
+      ecma_number_t *num_p = ecma_alloc_number ();
+      ecma_value_t accumulator = ecma_make_simple_value (ECMA_SIMPLE_VALUE_UNDEFINED);
+
       /* 6 */
       uint32_t index = len - 1;
       bool zero_reached = !len;
@@ -2236,10 +2237,10 @@ ecma_builtin_array_prototype_object_reduce_right (ecma_value_t this_arg, /**< th
       {
         ret_value = ecma_make_normal_completion_value (ecma_copy_value (accumulator, true));
       }
-    }
 
-    ecma_free_value (accumulator, true);
-    ecma_dealloc_number (num_p);
+      ecma_free_value (accumulator, true);
+      ecma_dealloc_number (num_p);
+    }
   }
 
   ECMA_OP_TO_NUMBER_FINALIZE (len_number);

tests/jerry/array_prototype_reduce_right.js

@@ -33,6 +33,14 @@ try {
   assert(e instanceof TypeError);
 }
 
+try {
+  var arg2;
+  [].reduceRight(func, arg2);
+  assert(false);
+} catch(e) {
+  assert(e instanceof TypeError);
+}
+
 // various checks
 assert([].reduceRight(func, 1) === 1);