[njs] Fixed RegExp.prototype.replace().

[Dmitry Volyntsev]

details:   https://hg.nginx.org/njs/rev/b67fc7398a83
branches:  
changeset: 2218:b67fc7398a83
user:      Dmitry Volyntsev <xeioex at nginx.com>
date:      Fri Oct 06 16:51:53 2023 -0700
description:
Fixed RegExp.prototype.replace().

The issue was introduced in cf85d0f8640a.

diffstat:

 src/njs_regexp.c |  13 +++++++++----
 1 files changed, 9 insertions(+), 4 deletions(-)

diffs (30 lines):

diff -r c16f64d334f2 -r b67fc7398a83 src/njs_regexp.c
--- a/src/njs_regexp.c	Fri Oct 06 16:49:59 2023 -0700
+++ b/src/njs_regexp.c	Fri Oct 06 16:51:53 2023 -0700
@@ -1541,10 +1541,6 @@ njs_regexp_prototype_symbol_replace(njs_
                                               arguments, ncaptures, &groups,
                                               replace, retval);
 
-            if (njs_object_slots(r)) {
-                njs_regexp_exec_result_free(vm, njs_array(r));
-            }
-
         } else {
             ret = njs_array_expand(vm, array, 0,
                                    njs_is_defined(&groups) ? 3 : 2);
@@ -1586,6 +1582,15 @@ njs_regexp_prototype_symbol_replace(njs_
 
             next_pos = pos + (int64_t) m.length;
         }
+
+        if (!func_replace && njs_object_slots(r)) {
+            /*
+              * Doing free here ONLY for non-function replace, because
+              * otherwise we cannot be certain the result of match
+              * was not stored elsewhere.
+              */
+            njs_regexp_exec_result_free(vm, njs_array(r));
+        }
     }
 
     if (next_pos < (int64_t) s.size) {