avoid freeing an object structure in js_weakref_free() if it is about to be freed in free_zero_refcount()

1 files changed, 26 insertions, 0 deletions

diff --git a/tests/test_builtin.js b/tests/test_builtin.js
index 1ba59cd..7ff303f 100644
--- a/tests/test_builtin.js
+++ b/tests/test_builtin.js
@@ -809,6 +809,31 @@ function test_weak_map()
     /* the WeakMap should be empty here */
 }
 
+function test_weak_map_cycles()
+{
+    const weak1 = new WeakMap();
+    const weak2 = new WeakMap();
+    function createCyclicKey() {
+        const parent = {};
+        const child = {parent};
+        parent.child = child;
+        return child;
+    }
+    function testWeakMap() {
+        const cyclicKey = createCyclicKey();
+        const valueOfCyclicKey = {};
+        weak1.set(cyclicKey, valueOfCyclicKey);
+        weak2.set(valueOfCyclicKey, 1);
+    }
+    testWeakMap();
+    // Force to free cyclicKey.
+    std.gc();
+    // Here will cause sigsegv because [cyclicKey] and [valueOfCyclicKey] in [weak1] was free,
+    // but weak2's map record was not removed, and it's key refers [valueOfCyclicKey] which is free.
+    weak2.get({});
+    std.gc();
+}
+
 function test_weak_ref()
 {
     var w1, w2, o, i;
@@ -953,6 +978,7 @@ test_regexp();
 test_symbol();
 test_map();
 test_weak_map();
+test_weak_map_cycles();
 test_weak_ref();
 test_finalization_registry();
 test_generator();