incomplete creation for RegExp object

[sunlili]

version: jsish 3.5.0
os: ubuntu 20.04
crash: segment fault caused by a null-ptr dereference

poc1:

var V0 = (new RegExp ( /test/ ));

poc2:

try {
    const V1 = ([] . forEach);
    new RegExp ( "[d-G\\B]" ) . exec ( V1 ) ;
 } catch (V1) {
 }

My fuzzer finds those crashes, and I notice the latest fix. But, the fix seems to be incorrect. In poc1, when the RegExp is created:

jsish/src/jsiRegexp.c

Lines 150 to 154 in 4e5066c

	else {
	Jsi_Obj *o = Jsi_ObjNewType(interp, JSI_OT_REGEXP);
	Jsi_ValueMakeObject(interp, ret, o);
	target = *ret;
	}

only JSI_OT_REGEXP field is set. The re expr /test/ is not assigned to the RegExp object in here or later. So, the RegExp object is incomplete. However, in following operations, the code assumes the RegExp object is complete, which causes the null-ptr dereference.

ISec Lab.