From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Thu, 21 May 2026 23:50:41 +0000 (-0700)
Subject: QuickJS: fixed Buffer.toJSON() data ownership
X-Git-Tag: 1.0.0~52
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/static/gitweb.js?a=commitdiff_plain;h=cc17225d10154565a82de709fab8465931b876b0;p=njs.git

QuickJS: fixed Buffer.toJSON() data ownership

The property definition consumes ownership, so freeing the result object
is enough on later error paths.

Returned JS_EXCEPTION on property-definition failures instead of the
unrelated typed-array lookup result.
---

diff --git a/src/qjs_buffer.c b/src/qjs_buffer.c
index 90515f74..aa597764 100644
--- a/src/qjs_buffer.c
+++ b/src/qjs_buffer.c
@@ -1347,22 +1347,20 @@ qjs_buffer_prototype_to_json(JSContext *ctx, JSValueConst this_val, int argc,
     if (rc == -1) {
         JS_FreeValue(ctx, obj);
         JS_FreeValue(ctx, data);
-        return ret;
+        return JS_EXCEPTION;
     }
 
     rc = JS_DefinePropertyValueStr(ctx, obj, "data", data, JS_PROP_ENUMERABLE);
     if (rc == -1) {
         JS_FreeValue(ctx, obj);
-        JS_FreeValue(ctx, data);
-        return ret;
+        return JS_EXCEPTION;
     }
 
     for (i = 0; i < src.length; i++) {
         rc = JS_SetPropertyUint32(ctx, data, i, JS_NewInt32(ctx, src.start[i]));
         if (rc == -1) {
             JS_FreeValue(ctx, obj);
-            JS_FreeValue(ctx, data);
-            return ret;
+            return JS_EXCEPTION;
         }
     }