Fix value release in ecma_builtin_regexp_dispatch_helper

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]

Author: szilagyiadam

jerry-core/ecma/builtin-objects/ecma-builtin-regexp.c

@@ -131,6 +131,7 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
 
       if (ECMA_IS_VALUE_ERROR (flags_value))
       {
+        ecma_free_value (pattern_value);
         return flags_value;
       }
     }
@@ -151,6 +152,12 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
 
   if (JERRY_UNLIKELY (new_target_obj_p == NULL))
   {
+    if (pattern_is_regexp)
+    {
+      ecma_free_value (pattern_value);
+      ecma_free_value (flags_value);
+    }
+
     return ECMA_VALUE_ERROR;
   }
 
@@ -171,6 +178,12 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
   }
 #endif /* ENABLED (JERRY_ES2015) */
 
+  if (pattern_is_regexp)
+  {
+    ecma_free_value (pattern_value);
+    ecma_free_value (flags_value);
+  }
+
   if (ECMA_IS_VALUE_ERROR (ret_value))
   {
     ecma_deref_object (new_target_obj_p);

tests/jerry/es2015/regression-test-issue-3671.js

@@ -0,0 +1,23 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var obj = {
+  get source() {
+      return "Iam"
+  },
+  [Symbol.match]: true
+}
+
+var regexp = new RegExp(obj);
+print(regexp.source === "Iam");