[Medios-lgtm]

Summary

getSubstitution resolves a $<name> reference by slicing the replacement string and calling StringView::getUTF16Ref. For a UTF-16 replacement that call does not copy, it returns a raw pointer straight into the replacement StringPrimitive on the GC heap. That pointer is handed to IdentifierTable::getSymbolHandle, which, when the name is not already interned, allocates a long-lived DynamicStringPrimitive and only afterwards copies the characters from the caller's pointer. allocateDynamicString re-reads its input through primHandle after that allocation for exactly this reason, but a bare UTF16Ref gives it no handle to re-read, so a GC in the window moves the replacement string and the copy reads freed memory into the new identifier.

Any script reaches it through String.prototype.replace / replaceAll with a named-group RegExp, a UTF-16 replacement string, and a group name not yet interned, e.g. 'abc'.replace(new RegExp('(?<' + n + '>b)'), '[$<' + n + '>]'). In the default Hades config a long-lived allocation does not start a young-gen collection so the stale read usually survives; under HERMESVM_SANITIZE_HANDLES a collection runs on every allocation and it faults every time.

The fix copies the name into the SmallVector that is already declared, with appendUTF16String, before the lookup, the same shape Callable.cpp uses to build a bound function's name. getUTF16Ref has no other caller that feeds the result into an allocating function.

Test Plan

Added test/hermes/regexp-replace-named-group-gc.js, which runs under -gc-sanitize-handles=1.

Before the fix, built with -DHERMESVM_SANITIZE_HANDLES=ON -DHERMESVM_GCKIND=MALLOC -DHERMES_ENABLE_ADDRESS_SANITIZER=ON, the reproducer aborts:

==ERROR: AddressSanitizer: heap-use-after-free
READ of size 38 ... in __asan_memmove
  #1 IdentifierTable::allocateDynamicString<char16_t, true>(...)
  #3 IdentifierTable::getSymbolHandle(...)
  #4 hermes::vm::getSubstitution(...)
  #5 hermes::vm::regExpPrototypeSymbolReplace(...)
freed by thread T0 here:
  #1 MallocGC::collect(...)
  #3 GCBase::makeA<DynamicStringPrimitive<char16_t, true>, ... LongLived ...>
  #4 IdentifierTable::allocateDynamicString<char16_t, true>(...)

After the fix the same sanitize build prints the expected output and ASan is quiet:

named group replacement
a[b]c
<1>-<2>-<3>
xz

In the default ASan+Debug (Hades) build the new test passes and the full regexp lit subset is green (21 passed, 1 unsupported). clang-format --dry-run --Werror is clean on the changed file.