From 14a3b9188dfd5bc642bc74681523d0a43e308811 Mon Sep 17 00:00:00 2001
From: yangguo <yangguo@chromium.org>
Date: Mon, 24 Nov 2014 03:21:45 -0800
Subject: [PATCH] Fix RegExp.source for uncompiled regexp.

R=jkummerow@chromium.org
BUG=435825
LOG=N

Review URL: https://codereview.chromium.org/753983002

Cr-Commit-Position: refs/heads/master@{#25476}
---
 src/accessors.cc                             | 15 +++++++++------
 test/mjsunit/regress/regress-crbug-435825.js | 11 +++++++++++
 2 files changed, 20 insertions(+), 6 deletions(-)
 create mode 100644 test/mjsunit/regress/regress-crbug-435825.js

diff --git a/src/accessors.cc b/src/accessors.cc
index c108236b85..6b7ec058d9 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -385,13 +385,16 @@ void Accessors::RegExpSourceGetter(
   Handle<Object> receiver =
       Utils::OpenHandle(*v8::Local<v8::Value>(info.This()));
   Handle<JSRegExp> regexp = Handle<JSRegExp>::cast(receiver);
-  Handle<String> pattern(regexp->Pattern(), isolate);
-  MaybeHandle<String> maybe = EscapeRegExpSource(isolate, pattern);
-
   Handle<String> result;
-  if (!maybe.ToHandle(&result)) {
-    isolate->OptionalRescheduleException(false);
-    return;
+  if (regexp->TypeTag() == JSRegExp::NOT_COMPILED) {
+    result = isolate->factory()->empty_string();
+  } else {
+    Handle<String> pattern(regexp->Pattern(), isolate);
+    MaybeHandle<String> maybe = EscapeRegExpSource(isolate, pattern);
+    if (!maybe.ToHandle(&result)) {
+      isolate->OptionalRescheduleException(false);
+      return;
+    }
   }
   info.GetReturnValue().Set(Utils::ToLocal(result));
 }
diff --git a/test/mjsunit/regress/regress-crbug-435825.js b/test/mjsunit/regress/regress-crbug-435825.js
new file mode 100644
index 0000000000..e10b812d4d
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-435825.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function (a,b) { return b; };
+
+try {
+  /(invalid regexp/;
+} catch (e) {
+  e.stack[0].getThis().toString();
+}