RegExp.prototype[@@replace] needs to clone input regexp for elem-base path

RESOLVED FIXED in Firefox 55

Status

()

defect
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: anba, Assigned: anba)

Tracking

Trunk
mozilla55
Points:
---

Firefox Tracking Flags

(firefox54 wontfix, firefox55 fixed)

Details

Attachments

(1 attachment)

Test case:
---
(function() {
    var r = /a/g;
    var b = {
        get a() {
            r.compile("b");
            return "A";
        }
    };
    print(r[Symbol.replace]("aaa", function(a) { return b[a] }));
})();
---

Expected: Prints "AAA"
Actual: Prints "Aaa"

Similar to bug 1290506.
Similar to the "functional" case, we need to make sure the input RegExp wasn't modified for the "elembase" optimized path.
Assignee: nobody → andrebargull
Status: NEW → ASSIGNED
Attachment #8874394 - Flags: review?(till)
Comment on attachment 8874394 [details] [diff] [review]
bug1343363.patch

Review of attachment 8874394 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch! r=me
Attachment #8874394 - Flags: review?(till) → review+
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7fe1ee54c97b
Check RegExp wasn't modified in RegExp.p.@@replace global elem-base optimized path. r=till
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/7fe1ee54c97b
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
54 RC build is released. Mark 54 won't fix.
You need to log in before you can comment on or make changes to this bug.