QuickJS: fixed Buffer.toJSON() data ownership

The property definition consumes ownership, so freeing the result object
is enough on later error paths.

Returned JS_EXCEPTION on property-definition failures instead of the
unrelated typed-array lookup result.

diff --git a/src/qjs_buffer.c b/src/qjs_buffer.c
index 90515f7443b6c5b8bda430d91c2cba86196846ba..aa597764587ef1381257a51fa62d08594ec9e470 100644 (file)
--- a/src/qjs_buffer.c
+++ b/src/qjs_buffer.c
@@ -1347,22 +1347,20 @@ qjs_buffer_prototype_to_json(JSContext *ctx, JSValueConst this_val, int argc,
     if (rc == -1) {
         JS_FreeValue(ctx, obj);
         JS_FreeValue(ctx, data);
-        return ret;
+        return JS_EXCEPTION;
     }
 
     rc = JS_DefinePropertyValueStr(ctx, obj, "data", data, JS_PROP_ENUMERABLE);
     if (rc == -1) {
         JS_FreeValue(ctx, obj);
-        JS_FreeValue(ctx, data);
-        return ret;
+        return JS_EXCEPTION;
     }
 
     for (i = 0; i < src.length; i++) {
         rc = JS_SetPropertyUint32(ctx, data, i, JS_NewInt32(ctx, src.start[i]));
         if (rc == -1) {
             JS_FreeValue(ctx, obj);
-            JS_FreeValue(ctx, data);
-            return ret;
+            return JS_EXCEPTION;
         }
     }