Closed Bug 1343363 Opened 3 years ago Closed 3 years ago

RegExp.prototype[@@replace] needs to clone input regexp for elem-base path

Categories

(Core :: JavaScript: Standard Library, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla55
Tracking Status
firefox54 --- wontfix
firefox55 --- fixed

People

(Reporter: anba, Assigned: anba)

Details

Attachments

(1 file)

Test case:
---
(function() {
    var r = /a/g;
    var b = {
        get a() {
            r.compile("b");
            return "A";
        }
    };
    print(r[Symbol.replace]("aaa", function(a) { return b[a] }));
})();
---

Expected: Prints "AAA"
Actual: Prints "Aaa"

Similar to bug 1290506.
Attached patch bug1343363.patchSplinter Review
Similar to the "functional" case, we need to make sure the input RegExp wasn't modified for the "elembase" optimized path.
Assignee: nobody → andrebargull
Status: NEW → ASSIGNED
Attachment #8874394 - Flags: review?(till)
Comment on attachment 8874394 [details] [diff] [review]
bug1343363.patch

Review of attachment 8874394 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch! r=me
Attachment #8874394 - Flags: review?(till) → review+
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7fe1ee54c97b
Check RegExp wasn't modified in RegExp.p.@@replace global elem-base optimized path. r=till
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/7fe1ee54c97b
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
54 RC build is released. Mark 54 won't fix.
You need to log in before you can comment on or make changes to this bug.