Follow up fix 2 for bug 623435. (r=brendan)

--HG--
extra : rebase_source : 5c9b8aec39f707f0539b1a9e299f8a5fcc5ee753

js/src/jsregexp.cpp

@@ -252,7 +252,6 @@ bool
 RegExp::parseFlags(JSContext *cx, JSString *flagStr, uintN *flagsOut)
 {
     size_t n = flagStr->length();
-    Anchor<JSString *> afs(flagStr);
     const jschar *s = flagStr->getChars(cx);
     if (!s)
         return false;
@@ -847,7 +846,10 @@ regexp_construct(JSContext *cx, uintN argc, Value *vp)
     uintN flags = 0;
     if (argc > 1 && !argv[1].isUndefined()) {
         JSString *flagStr = js_ValueToString(cx, argv[1]);
-        if (!flagStr || !RegExp::parseFlags(cx, flagStr, &flags))
+        if (!flagStr)
+            return false;
+        argv[1].setString(flagStr);
+        if (!RegExp::parseFlags(cx, flagStr, &flags))
             return false;
     }
 

js/src/jsregexpinlines.h

@@ -140,6 +140,8 @@ class RegExp
     /*
      * Parse regexp flags. Report an error and return false if an invalid
      * sequence of flags is encountered (repeat/invalid flag).
+     *
+     * N.B. flagStr must be rooted.
      */
     static bool parseFlags(JSContext *cx, JSString *flagStr, uintN *flagsOut);