Re-sync with internal repository (facebook#856)

Co-authored-by: Facebook Community Bot <[email protected]>

lib/VM/JSObject.cpp

@@ -118,16 +118,8 @@ PseudoHandle<JSObject> JSObject::create(
     Runtime &runtime,
     Handle<JSObject> parentHandle,
     Handle<HiddenClass> clazz) {
-  auto *cell = runtime.makeAFixed<JSObject>(
-      runtime, parentHandle, clazz, GCPointerBase::NoBarriers());
-  auto obj = JSObjectInit::initToPseudoHandle(runtime, cell);
-
-  obj->clazz_.setNonNull(runtime, *clazz, runtime.getHeap());
-  // If the hidden class has index like property, we need to clear the fast path
-  // flag.
-  if (LLVM_UNLIKELY(
-          obj->clazz_.getNonNull(runtime)->getHasIndexLikeProperties()))
-    obj->flags_.fastIndexProperties = false;
+  PseudoHandle<JSObject> obj = JSObject::create(runtime, clazz);
+  obj->parent_.set(runtime, parentHandle.get(), runtime.getHeap());
   return obj;
 }
 

lib/VM/JSRegExp.cpp

@@ -176,6 +176,7 @@ ExecutionStatus JSRegExp::initializeGroupNameMappingObj(
     Handle<JSRegExp> selfHandle,
     std::deque<llvh::SmallVector<char16_t, 5>> &orderedNamedGroups,
     regex::ParsedGroupNamesMapping &parsedMappings) {
+  GCScope gcScope(runtime);
   if (parsedMappings.size() == 0)
     return ExecutionStatus::RETURNED;
 
@@ -184,6 +185,7 @@ ExecutionStatus JSRegExp::initializeGroupNameMappingObj(
 
   MutableHandle<HermesValue> numberHandle{runtime};
   for (const auto &identifier : orderedNamedGroups) {
+    GCScopeMarkerRAII marker{gcScope};
     auto symbolRes =
         runtime.getIdentifierTable().getSymbolHandle(runtime, identifier);
     if (LLVM_UNLIKELY(symbolRes == ExecutionStatus::EXCEPTION)) {

test/hermes/regress-named-capture-group.js

@@ -0,0 +1,22 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+// RUN: %hermes -O %s
+
+// Check Regex doesn't crash due to an underlying unitialized propStorage_.
+// There was a bug that the hidden class of the named capture group mapping
+// object would not have a properly initialized propStorage_.
+// Thus, once the number of named groups exceeded the number of direct
+// property slots, it crashed when trying to assign properties to
+// the uninitialized propStorage_.
+
+var s = '';
+for (let i = 0; i < 1000; i++) {
+  s += `(?<foo${i}>a)`;
+}
+var re = new RegExp(s);
+print(re.exec(""))