From 385b988e69ec0fc8a5b2de698544e8722f489b33 Mon Sep 17 00:00:00 2001
From: Ruben Ayrapetyan <r.ayrapetyan@samsung.com>
Date: Fri, 5 Jun 2015 15:28:41 +0300
Subject: [PATCH] Fix of memory leak in
 ecma_op_function_construct_simple_or_external.

Related issue: #121

JerryScript-DCO-1.0-Signed-off-by: Ruben Ayrapetyan r.ayrapetyan@samsung.com
---
 .../ecma/operations/ecma-function-object.cpp  | 25 ++++++++++--------
 tests/jerry/regression-test-issue-121.js      | 26 +++++++++++++++++++
 2 files changed, 40 insertions(+), 11 deletions(-)
 create mode 100644 tests/jerry/regression-test-issue-121.js

diff --git a/jerry-core/ecma/operations/ecma-function-object.cpp b/jerry-core/ecma/operations/ecma-function-object.cpp
index a06acb90d4..250ee86c22 100644
--- a/jerry-core/ecma/operations/ecma-function-object.cpp
+++ b/jerry-core/ecma/operations/ecma-function-object.cpp
@@ -741,23 +741,24 @@ ecma_op_function_construct_simple_or_external (ecma_object_t *func_obj_p, /**< F
                                       prototype_magic_string_p),
                   ret_value);
 
-  //  6.
-  ecma_object_t *prototype_p;
+  // 1., 2., 4.
+  ecma_object_t *obj_p;
   if (ecma_is_value_object (func_obj_prototype_prop_value))
   {
-    prototype_p = ecma_get_object_from_value (func_obj_prototype_prop_value);
-    ecma_ref_object (prototype_p);
+    //  6.
+    obj_p = ecma_create_object (ecma_get_object_from_value (func_obj_prototype_prop_value),
+                                true,
+                                ECMA_OBJECT_TYPE_GENERAL);
   }
   else
   {
     // 7.
-    prototype_p = ecma_builtin_get (ECMA_BUILTIN_ID_OBJECT_PROTOTYPE);
-  }
+    ecma_object_t *prototype_p = ecma_builtin_get (ECMA_BUILTIN_ID_OBJECT_PROTOTYPE);
 
-  // 1., 2., 4.
-  ecma_object_t *obj_p = ecma_create_object (prototype_p, true, ECMA_OBJECT_TYPE_GENERAL);
+    obj_p = ecma_create_object (prototype_p, true, ECMA_OBJECT_TYPE_GENERAL);
 
-  ecma_deref_object (prototype_p);
+    ecma_deref_object (prototype_p);
+  }
 
   // 3.
   /*
@@ -781,19 +782,21 @@ ecma_op_function_construct_simple_or_external (ecma_object_t *func_obj_p, /**< F
   // 9.
   if (ecma_is_value_object (call_completion))
   {
-    ecma_deref_object (obj_p);
-
     obj_value = ecma_copy_value (call_completion, true);
   }
   else
   {
     // 10.
+    ecma_ref_object (obj_p);
     obj_value = ecma_make_object_value (obj_p);
   }
 
   ret_value = ecma_make_normal_completion_value (obj_value);
 
   ECMA_FINALIZE (call_completion);
+
+  ecma_deref_object (obj_p);
+
   ECMA_FINALIZE (func_obj_prototype_prop_value);
 
   ecma_deref_ecma_string (prototype_magic_string_p);
diff --git a/tests/jerry/regression-test-issue-121.js b/tests/jerry/regression-test-issue-121.js
new file mode 100644
index 0000000000..9c8f0ea73a
--- /dev/null
+++ b/tests/jerry/regression-test-issue-121.js
@@ -0,0 +1,26 @@
+// Copyright 2015 Samsung Electronics Co., Ltd.
+// Copyright 2015 University of Szeged.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+try {
+  function f_1() {
+    v_1 + v_1;
+  }
+
+  f_1(new f_1);
+
+  assert (false);
+} catch (e) {
+  assert (e instanceof ReferenceError);
+}