Fixed RegExp.prototype.replace().

The issue was introduced in cf85d0f8640a.

diff --git a/src/njs_regexp.c b/src/njs_regexp.c
index 839fc8de95dca045d4a8b9a5f660d23b3f6a5f15..970041d6283d95e5dba7e19a641330eb7f89ca03 100644 (file)
--- a/src/njs_regexp.c
+++ b/src/njs_regexp.c
@@ -1541,10 +1541,6 @@ njs_regexp_prototype_symbol_replace(njs_vm_t *vm, njs_value_t *args,
                                               arguments, ncaptures, &groups,
                                               replace, retval);
 
-            if (njs_object_slots(r)) {
-                njs_regexp_exec_result_free(vm, njs_array(r));
-            }
-
         } else {
             ret = njs_array_expand(vm, array, 0,
                                    njs_is_defined(&groups) ? 3 : 2);
@@ -1586,6 +1582,15 @@ njs_regexp_prototype_symbol_replace(njs_vm_t *vm, njs_value_t *args,
 
             next_pos = pos + (int64_t) m.length;
         }
+
+        if (!func_replace && njs_object_slots(r)) {
+            /*
+              * Doing free here ONLY for non-function replace, because
+              * otherwise we cannot be certain the result of match
+              * was not stored elsewhere.
+              */
+            njs_regexp_exec_result_free(vm, njs_array(r));
+        }
     }
 
     if (next_pos < (int64_t) s.size) {