From a026a7d7137ab573bcf7c14accf3c1770c487288 Mon Sep 17 00:00:00 2001
From: Robert Fancsik <frobert@inf.u-szeged.hu>
Date: Wed, 17 Jun 2020 19:24:07 +0200
Subject: [PATCH] Fix releasing 'exec' in regexp replace fast path (#3913)

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
---
 jerry-core/ecma/operations/ecma-regexp-object.c |  4 +---
 tests/jerry/es.next/symbol-replace.js           | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/jerry-core/ecma/operations/ecma-regexp-object.c b/jerry-core/ecma/operations/ecma-regexp-object.c
index e6e84c47a..a6ee37a70 100644
--- a/jerry-core/ecma/operations/ecma-regexp-object.c
+++ b/jerry-core/ecma/operations/ecma-regexp-object.c
@@ -2793,6 +2793,7 @@ ecma_regexp_replace_helper (ecma_value_t this_arg, /**< this argument */
     if (ecma_object_class_is (this_obj_p, LIT_MAGIC_STRING_REGEXP_UL)
         && ecma_builtin_is_regexp_exec (function_p))
     {
+      ecma_deref_object ((ecma_object_t *) function_p);
       result = ecma_op_object_get_by_magic_id (this_obj_p, LIT_MAGIC_STRING_STICKY);
       if (ECMA_IS_VALUE_ERROR (result))
       {
@@ -2817,8 +2818,6 @@ ecma_regexp_replace_helper (ecma_value_t this_arg, /**< this argument */
 
         if (replace_ctx.index > string_length)
         {
-          ecma_deref_object ((ecma_object_t *) function_p);
-
           result = ecma_op_object_put (this_obj_p,
                                        ecma_get_magic_string (LIT_MAGIC_STRING_LASTINDEX_UL),
                                        ecma_make_uint32_value (0),
@@ -2840,7 +2839,6 @@ ecma_regexp_replace_helper (ecma_value_t this_arg, /**< this argument */
                                                 string_p,
                                                 replace_arg);
 
-      ecma_deref_object ((ecma_object_t *) function_p);
       goto cleanup_replace;
     }
   }
diff --git a/tests/jerry/es.next/symbol-replace.js b/tests/jerry/es.next/symbol-replace.js
index 46de3288e..e5f47c59b 100644
--- a/tests/jerry/es.next/symbol-replace.js
+++ b/tests/jerry/es.next/symbol-replace.js
@@ -672,3 +672,17 @@ class Regexplike2 {
 }
 re = new Regexplike2();
 assert (replace.call (re, "1") === "undefined");
+
+var abruptStickyRegexp = /./;
+Object.defineProperty(abruptStickyRegexp, 'sticky', {
+  get: function() {
+    throw "abrupt sticky";
+  }
+});
+
+try {
+  abruptStickyRegexp[Symbol.replace]();
+  assert(false);
+} catch (e) {
+  assert(e === "abrupt sticky");
+}