From f1c61c8e2d5e08bfa046b850df376bc179f3653a Mon Sep 17 00:00:00 2001
From: win7-7 <win7-7@users.noreply.github.com>
Date: Sun, 18 Jan 2026 09:29:32 +0200
Subject: [PATCH] Fix remaining errors from mixing two different approaches.

Fix remaining errors from mixing two different approaches.
---
 js/src/vm/RegExpObject.cpp | 22 +++++++++++++++-------
 js/src/vm/RegExpShared.h   |  8 +-------
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index b75d4f3b32..70fc47b949 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -958,16 +958,17 @@ RegExpShared::RegExpShared(JSAtom* source, RegExpFlag flags)
 {}
 
 struct RegExpShared::NamedCaptureData {
-	bool mapInited;
     // per-compartment template cache (optional; you can also skip templates entirely)
     using GroupsTemplateMap =
         GCHashMap<JSCompartment*, ReadBarriered<PlainObject*>,
                   DefaultHasher<JSCompartment*>, SystemAllocPolicy>;
     GroupsTemplateMap groupsTemplateMap;
-    bool groupsTemplateMapInited = false;
+    bool groupsTemplateMapInited;
 
     Vector<JSAtom*, 0, SystemAllocPolicy> names;
     Vector<uint32_t, 0, SystemAllocPolicy> indices;
+
+    NamedCaptureData() : groupsTemplateMapInited(false) {}
 };
 
 void
@@ -977,14 +978,16 @@ RegExpShared::traceChildren(JSTracer* trc)
     if (IsMarkingTrace(trc) && trc->runtime()->gc.isShrinkingGC())
         discardJitCode();
 
-    if (namedCaptureData_ && namedCaptureData_->mapInited) {
+    if (namedCaptureData_ && namedCaptureData_->groupsTemplateMapInited) {
 	  for (auto iter = namedCaptureData_->groupsTemplateMap.all(); !iter.empty(); iter.popFront()) {
         TraceNullableEdge(trc, &iter.front().value(), "RegExpShared groupsTemplate per-compartment");
       }
     }
 
-    for (auto& atom : namedCaptureNames_) {
-    TraceEdge(trc, &atom, "RegExpShared namedCaptureName");
+    if (namedCaptureData_) {
+      for (JSAtom*& atom : namedCaptureData_->names) {
+        TraceEdge(trc, &atom, "RegExpShared namedCaptureName");
+      }
     }
 
     TraceNullableEdge(trc, &source, "RegExpShared source");
@@ -1005,6 +1008,11 @@ RegExpShared::discardJitCode()
 void
 RegExpShared::finalize(FreeOp* fop)
 {
+	if (namedCaptureData_) {
+        js_delete(namedCaptureData_);
+        namedCaptureData_ = nullptr;
+    }
+
     for (auto& comp : compilationArray)
         js_free(comp.byteCode);
     tables.~JitCodeTables();
@@ -1401,10 +1409,10 @@ RegExpShared::getOrCreateGroupsTemplate(JSContext* cx)
 
     NamedCaptureData* data = namedCaptureData_;
 
-    if (!data->mapInited) {
+    if (!data->groupsTemplateMapInited) {
         if (!data->groupsTemplateMap.init(4))
             return nullptr;
-        data->mapInited = true;
+        data->groupsTemplateMapInited = true;
     }
 
     JSCompartment* comp = cx->compartment();
diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
index 0f617936a6..dfb80a79cd 100644
--- a/js/src/vm/RegExpShared.h
+++ b/js/src/vm/RegExpShared.h
@@ -132,13 +132,7 @@ class RegExpShared : public gc::TenuredCell
     uint32_t            numNamedCaptures_;
     NamedCaptureData* namedCaptureData_;   // nullptr if none
 	public:
-  NamedCaptureData* namedCaptureData() const { return namedCaptureData_; }
-
-bool namedCaptureDataInited_;
-
-// NEW: realm-neutral named-capture data stored on the shared regexp
-Vector<GCPtr<JSAtom*>, 0, SystemAllocPolicy> namedCaptureNames_;
-Vector<uint32_t, 0, SystemAllocPolicy> namedCaptureIndices_;
+    NamedCaptureData* namedCaptureData() const { return namedCaptureData_; }
 
     RegExpCompilation  compilationArray[4];