Bug 205785

Summary: String.prototype.replace() incorrectly handles named references on RegExp w/o named groups
Product: WebKit Reporter: Alexey Shvayka <ashvayka>
Component: JavaScriptCoreAssignee: Alexey Shvayka <ashvayka>
Status: RESOLVED FIXED    
Severity: Minor CC: commit-queue, ews-watchlist, keith_miller, mark.lam, msaboff, nisl_grammarly1, ross.kirsling, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
See Also: https://bugs.webkit.org/show_bug.cgi?id=176814
https://bugs.webkit.org/show_bug.cgi?id=176434
https://bugs.webkit.org/show_bug.cgi?id=205783
Attachments:
Description Flags
Patch none

Alexey Shvayka
Reported 2020-01-05 21:52:51 PST
Test case: "ab".replace(/a/, "$<c>$<d>") Expected: "$<c>$<d>b" Actual: "$<$<d>b" ECMA262: https://tc39.es/ecma262/#sec-getsubstitution (step 11) Test262: https://test262.report/browse/built-ins/RegExp/named-groups/string-replace-nocaptures.js
Attachments
Patch (4.64 KB, patch)
2020-01-05 22:16 PST, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Alexey Shvayka
Comment 1 2020-01-05 22:16:03 PST
Created attachment 386812 [details] Patch
Ross Kirsling
Comment 2 2020-01-06 11:20:02 PST
Comment on attachment 386812 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=386812&action=review Wow, what an interesting bug. r=me, but a couple of questions. > Source/JavaScriptCore/runtime/StringPrototype.cpp:-226 > - result.append(replacement.substring(i, 2)); > - offset = i + 2; > - advance = 1; So was this the correct behavior prior to named capture groups? Or is this too associated with https://github.com/tc39/proposal-regexp-named-groups/issues/29? > Source/JavaScriptCore/runtime/StringPrototype.cpp:-232 > - // FIXME: https://bugs.webkit.org/show_bug.cgi?id=176434 We should also close the referenced bug, right?
Alexey Shvayka
Comment 3 2020-01-06 11:45:21 PST
(In reply to Ross Kirsling from comment #2) > So was this the correct behavior prior to named capture groups? Or is this > too associated with > https://github.com/tc39/proposal-regexp-named-groups/issues/29? No, I believe it wasn't. For backwards compatibility, named capture groups leave "$<..>" as-is for a RegExp w/o named groups. This patch isn't associated with https://github.com/tc39/proposal-regexp-named-groups/issues/29: I've only removed FIXMEs to avoid submitting another patch. > We should also close the referenced bug, right? I've just closed https://bugs.webkit.org/show_bug.cgi?id=176434, thank you.
WebKit Commit Bot
Comment 4 2020-01-06 14:46:49 PST
The commit-queue encountered the following flaky tests while processing attachment 386812 [details]: transitions/default-timing-function.html bug 138901 (authors: dino@apple.com and graouts@apple.com) The commit-queue is continuing to process your patch.
WebKit Commit Bot
Comment 5 2020-01-06 14:47:42 PST
Comment on attachment 386812 [details] Patch Clearing flags on attachment: 386812 Committed r254088: <https://trac.webkit.org/changeset/254088>
WebKit Commit Bot
Comment 6 2020-01-06 14:47:44 PST
All reviewed patches have been landed. Closing bug.
Radar WebKit Bug Importer
Comment 7 2020-01-06 14:48:20 PST
<rdar://problem/58355159>
Alexey Shvayka
Comment 8 2020-06-12 02:10:54 PDT
*** Bug 213023 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.