Fix regexp flag handling in case of regexp like object (#3766)

The regexp flag should be correctly referenced and released
if an existing regexp like object is used for constructing a new one.

JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.usz@partner.samsung.com

jerry-core/ecma/builtin-objects/ecma-builtin-regexp.c

@@ -138,6 +138,10 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
         return flags_value;
       }
     }
+    else
+    {
+      flags_value = ecma_copy_value (flags_value);
+    }
 
     free_arguments = true;
   }
@@ -153,35 +157,30 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
   }
 #endif /* ENABLED (JERRY_ES2015) */
 
+  ecma_value_t ret_value = ECMA_VALUE_ERROR;
   ecma_object_t *new_target_obj_p = ecma_op_regexp_alloc (new_target_p);
 
-  if (JERRY_UNLIKELY (new_target_obj_p == NULL))
+  if (JERRY_LIKELY (new_target_obj_p != NULL))
   {
 #if ENABLED (JERRY_ES2015)
-    if (free_arguments)
+    if (create_regexp_from_bc)
     {
-      ecma_free_value (pattern_value);
+      ret_value = ecma_op_create_regexp_from_bytecode (new_target_obj_p, bc_p);
-      ecma_free_value (flags_value);
+      JERRY_ASSERT (!ECMA_IS_VALUE_ERROR (ret_value));
     }
+    else
 #endif /* ENABLED (JERRY_ES2015) */
+    {
+      ret_value = ecma_op_create_regexp_from_pattern (new_target_obj_p, pattern_value, flags_value);
 
-    return ECMA_VALUE_ERROR;
+      if (ECMA_IS_VALUE_ERROR (ret_value))
+      {
+        ecma_deref_object (new_target_obj_p);
+      }
+    }
   }
 
-  ecma_value_t ret_value;
-
 #if ENABLED (JERRY_ES2015)
-  if (create_regexp_from_bc)
-  {
-    ret_value = ecma_op_create_regexp_from_bytecode (new_target_obj_p, bc_p);
-  }
-  else
-  {
-#endif /* ENABLED (JERRY_ES2015) */
-    ret_value = ecma_op_create_regexp_from_pattern (new_target_obj_p, pattern_value, flags_value);
-#if  ENABLED (JERRY_ES2015)
-  }
-
   if (free_arguments)
   {
     ecma_free_value (pattern_value);
@@ -189,11 +188,6 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
   }
 #endif /* ENABLED (JERRY_ES2015) */
 
-  if (ECMA_IS_VALUE_ERROR (ret_value))
-  {
-    ecma_deref_object (new_target_obj_p);
-  }
-
   return ret_value;
 } /* ecma_builtin_regexp_dispatch_helper */
 

tests/jerry/es2015/regression-test-issue-3760.js

@@ -0,0 +1,22 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var split = RegExp.prototype[Symbol.split];
+
+try {
+  split.call({[Symbol.match]: "g"});
+  assert(false);
+} catch (ex) {
+  assert(ex instanceof SyntaxError);
+}