Root the new string across the call to js_NewObject, etc. b=331793 r=brendan

js/src/jsregexp.c

@@ -4113,6 +4113,7 @@ js_NewRegExpObject(JSContext *cx, JSTokenStream *ts,
     JSString *str;
     JSObject *obj;
     JSRegExp *re;
+    JSTempValueRooter tvr;
 
     str = js_NewStringCopyN(cx, chars, length, 0);
     if (!str)
@@ -4120,11 +4121,13 @@ js_NewRegExpObject(JSContext *cx, JSTokenStream *ts,
     re = js_NewRegExp(cx, ts,  str, flags, JS_FALSE);
     if (!re)
         return NULL;
+    JS_PUSH_SINGLE_TEMP_ROOT(cx, STRING_TO_JSVAL(str), &tvr);
     obj = js_NewObject(cx, &js_RegExpClass, NULL, NULL);
     if (!obj || !JS_SetPrivate(cx, obj, re) || !js_SetLastIndex(cx, obj, 0)) {
         js_DestroyRegExp(cx, re);
-        return NULL;
+        obj = NULL;
     }
+    JS_POP_TEMP_ROOT(cx, &tvr);
     return obj;
 }