Repository: jerryscript-project/jerryscript
File: jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c (C)

Code before:
        return element_temp;
      }

      target_index++;
    }
  }
  return ecma_make_uint32_value (target_index);
} /* ecma_builtin_array_flatten_into_array */

/**
 * The Array.prototype object's 'flat' routine
 *
 * See also:
 *          ECMA-262 v10, 22.1.3.10
 *
 * @return ecma value
 *         Returned value must be freed with ecma_free_value.
 */
static ecma_value_t
ecma_builtin_array_prototype_object_flat (const ecma_value_t args[], /**< arguments list */
                                          ecma_length_t args_number, /**< number of arguments */
                                          ecma_object_t *obj_p, /**< array object */
                                          uint32_t len) /**< array object's length */
{
  ecma_number_t depthNum = 1;
  if (args_number > 0 || ECMA_IS_VALUE_ERROR (ecma_op_to_integer (args[0], &depthNum)))
  {
    return ECMA_VALUE_ERROR;
  }

  ecma_value_t new_array = ecma_op_array_species_create (obj_p, 0);

  if (ECMA_IS_VALUE_ERROR (new_array))
  {
    return new_array;
  }

  ecma_value_t flatten_val = ecma_builtin_array_flatten_into_array (new_array,
                                                                    obj_p,
                                                                    len,
                                                                    0,
                                                                    depthNum,
                                                                    ECMA_VALUE_UNDEFINED,
                                                                    ECMA_VALUE_UNDEFINED);

  if (ECMA_IS_VALUE_ERROR (flatten_val))
  {
    ecma_free_value (new_array);
    return flatten_val;
  }


Review comment (bug):
That's  definitely incorrect. `[1,2].flat(5)` would raises an error here, and `[1,2].flat()` leads to invalid array element access.

Code after:

        target_index = (ecma_length_t) ecma_get_number_from_value (target_index_val);
        continue;
      }
    }

    /* vi. */
    const uint8_t flags = ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE | ECMA_IS_THROW;
    ecma_value_t element_temp = ecma_builtin_helper_def_prop_by_index (ecma_get_object_from_value (target),
                                                                       target_index,
                                                                       element,
                                                                       flags);

    ecma_free_value (element);

    if (ECMA_IS_VALUE_ERROR (element_temp))
    {
      return element_temp;
    }

    target_index++;
  }
  /* 10. */
  return ecma_make_length_value (target_index);
} /* ecma_builtin_array_flatten_into_array */

/**
 * The Array.prototype object's 'flat' routine
 *
 * See also:
 *          ECMA-262 v10, 22.1.3.10
 *
 * @return ecma value
 *         Returned value must be freed with ecma_free_value.
 */
static ecma_value_t
ecma_builtin_array_prototype_object_flat (const ecma_value_t args[], /**< arguments list */
                                          uint32_t args_number, /**< number of arguments */
                                          ecma_object_t *obj_p, /**< array object */
                                          ecma_length_t len) /**< array object's length */
{
  /* 3. */
  ecma_number_t depth_num = 1;

  /* 4. */
  if (args_number > 0 && ECMA_IS_VALUE_ERROR (ecma_op_to_integer (args[0], &depth_num)))
  {
    return ECMA_VALUE_ERROR;
  }

  /* 5. */