fixed duplicate Invocation of the ArrayBuffer Release Callback (Divy Srivastava,...

diff --git a/quickjs.c b/quickjs.c
index 788c8f85e276d82ab35ac440e899ecf0b5b1cf25..9c6721794e839cec21e0c749d6159394c63e03e2 100644 (file)
--- a/quickjs.c
+++ b/quickjs.c
@@ -60994,8 +60994,13 @@ void JS_DetachArrayBuffer(JSContext *ctx, JSValueConst obj)
 
     if (!abuf || abuf->detached)
         return;
-    if (abuf->free_func)
+    if (abuf->free_func) {
         abuf->free_func(ctx->rt, abuf->opaque, abuf->data);
+        /* The backing data has been released. Do not release it again when
+           the detached ArrayBuffer object is later finalized. */
+        abuf->free_func = NULL;
+        abuf->opaque = NULL;
+    }
     abuf->data = NULL;
     abuf->byte_length = 0;
     abuf->detached = TRUE;
@@ -61160,6 +61165,8 @@ static JSValue js_array_buffer_transfer(JSContext *ctx,
         abuf->data = NULL;
         abuf->byte_length = 0;
         abuf->detached = TRUE;
+        abuf->free_func = NULL;
+        abuf->opaque = NULL;
         js_array_buffer_update_typed_arrays(abuf);
     }
     if (magic == JS_ARRAY_BUFFER_TRANSFER_TO_IMMUTABLE && !JS_IsException(res)) {