From 6d9d2328e9352dc2b3a1069d05b82204d73b69db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1niel=20B=C3=A1tyai?= <dbatyai@inf.u-szeged.hu>
Date: Tue, 9 Jun 2020 12:33:41 +0200
Subject: [PATCH] Fix built-in RegExp allocation with default constructor
 (#3883)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #3880.
Fixes #3881.

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai@inf.u-szeged.hu
---
 .../ecma/operations/ecma-regexp-object.c      | 20 +-----------------
 .../es2015/regression-test-issue-3880.js      | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+), 19 deletions(-)
 create mode 100644 tests/jerry/es2015/regression-test-issue-3880.js

diff --git a/jerry-core/ecma/operations/ecma-regexp-object.c b/jerry-core/ecma/operations/ecma-regexp-object.c
index 000b78cd3..82f22a463 100644
--- a/jerry-core/ecma/operations/ecma-regexp-object.c
+++ b/jerry-core/ecma/operations/ecma-regexp-object.c
@@ -210,32 +210,14 @@ ecma_object_t *
 ecma_op_regexp_alloc (ecma_object_t *ctr_obj_p) /**< constructor object pointer */
 {
 #if ENABLED (JERRY_ES2015)
-  bool default_alloc = false;
-
   if (ctr_obj_p == NULL)
   {
-    ecma_object_t *re_prototype_obj_p = ecma_builtin_get (ECMA_BUILTIN_ID_REGEXP_PROTOTYPE);
-
-    ecma_value_t ctr_value = ecma_op_object_get_by_magic_id (re_prototype_obj_p, LIT_MAGIC_STRING_CONSTRUCTOR);
-
-    if (ECMA_IS_VALUE_ERROR (ctr_value))
-    {
-      return NULL;
-    }
-
-    ctr_obj_p = ecma_get_object_from_value (ctr_value);
-
-    default_alloc = true;
+    ctr_obj_p = ecma_builtin_get (ECMA_BUILTIN_ID_REGEXP);
   }
 
   ecma_object_t *proto_obj_p = ecma_op_get_prototype_from_constructor (ctr_obj_p,
                                                                        ECMA_BUILTIN_ID_REGEXP_PROTOTYPE);
 
-  if (default_alloc)
-  {
-    ecma_deref_object (ctr_obj_p);
-  }
-
   if (JERRY_UNLIKELY (proto_obj_p == NULL))
   {
     return proto_obj_p;
diff --git a/tests/jerry/es2015/regression-test-issue-3880.js b/tests/jerry/es2015/regression-test-issue-3880.js
new file mode 100644
index 000000000..ec99fb76d
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-3880.js
@@ -0,0 +1,21 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+RegExp.prototype.constructor = ""
+var r = /a/;
+assert (r.test ("a"));
+
+RegExp.prototype.constructor = {}
+r = /b/;
+assert (r.test ("b"));