Fix value release in ecma_builtin_regexp_dispatch_helper

jerry-core/ecma/builtin-objects/ecma-builtin-regexp.c

@@ -52,6 +52,7 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
   ecma_value_t flags_value = ECMA_VALUE_UNDEFINED;
 #if ENABLED (JERRY_ES2015)
   bool create_regexp_from_bc = false;
+  bool free_arguments = false;
 #endif /* ENABLED (JERRY_ES2015) */
 
   if (arguments_list_len > 0)
@@ -131,9 +132,12 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
 
       if (ECMA_IS_VALUE_ERROR (flags_value))
       {
+        ecma_free_value (pattern_value);
         return flags_value;
       }
     }
+
+    free_arguments = true;
   }
 #else /* !ENABLED (JERRY_ES2015) */
   if (ecma_object_is_regexp_object (pattern_value))
@@ -151,6 +155,14 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
 
   if (JERRY_UNLIKELY (new_target_obj_p == NULL))
   {
+#if ENABLED (JERRY_ES2015)
+    if (free_arguments)
+    {
+      ecma_free_value (pattern_value);
+      ecma_free_value (flags_value);
+    }
+#endif /* ENABLED (JERRY_ES2015) */
+
     return ECMA_VALUE_ERROR;
   }
 
@@ -164,11 +176,15 @@ ecma_builtin_regexp_dispatch_helper (const ecma_value_t *arguments_list_p, /**<
   else
   {
 #endif /* ENABLED (JERRY_ES2015) */
-
     ret_value = ecma_op_create_regexp_from_pattern (new_target_obj_p, pattern_value, flags_value);
-
 #if  ENABLED (JERRY_ES2015)
   }
+
+  if (free_arguments)
+  {
+    ecma_free_value (pattern_value);
+    ecma_free_value (flags_value);
+  }
 #endif /* ENABLED (JERRY_ES2015) */
 
   if (ECMA_IS_VALUE_ERROR (ret_value))

tests/jerry/es2015/regression-test-issue-3671.js

@@ -0,0 +1,32 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var obj = {
+  get source() {
+      return "Iam"
+  },
+  [Symbol.match]: true
+}
+
+var regexp = new RegExp(obj);
+assert(regexp.source === "Iam");
+
+Object.defineProperty(obj, 'flags', {'get' : function () {throw 42}});
+
+try {
+  new RegExp(obj);
+  assert(false);
+} catch (e) {
+  assert(e === 42);
+}