Fixed njs_array_convert_to_slow_array().
Previously, the function might free invalid pointer, as array->start is
not always points to the beginning of allocated memory block.
This closes #540 issue on Github.
diff --git a/src/njs_array.c b/src/njs_array.c
index 6691d80..a973f30 100644
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -165,7 +165,7 @@
/* GC: release value. */
- njs_mp_free(vm->mem_pool, array->start);
+ njs_mp_free(vm->mem_pool, array->data);
array->start = NULL;
return NJS_OK;
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 46197cd..d338c79 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -4743,6 +4743,12 @@
"a.shift(); a"),
njs_str("2,3") },
+ { njs_str("var arr = [1,2];"
+ "arr.shift();"
+ "arr[2**20] = 3;"
+ "arr[2**20]"),
+ njs_str("3") },
+
{ njs_str("var a = []; a.splice()"),
njs_str("") },
