1343363 - RegExp.prototype[@@replace] needs to clone input regexp for elem-base path

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[André Bargull [:anba]]

Test case:
---
(function() {
    var r = /a/g;
    var b = {
        get a() {
            r.compile("b");
            return "A";
        }
    };
    print(r[Symbol.replace]("aaa", function(a) { return b[a] }));
})();
---

Expected: Prints "AAA"
Actual: Prints "Aaa"

Similar to bug 1290506.

Comment 1

[André Bargull [:anba]]

Attachment: bug1343363.patch

Similar to the "functional" case, we need to make sure the input RegExp wasn't modified for the "elembase" optimized path.

Comment 2

[Till Schneidereit [:till]]

Comment on attachment 8874394 [details] [diff] [review]
bug1343363.patch

Review of attachment 8874394 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch! r=me

Comment 3

[André Bargull [:anba]]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=5c2f4711c9d7c5e898216a8a1a893dded9170aa5

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7fe1ee54c97b
Check RegExp wasn't modified in RegExp.p.@@replace global elem-base optimized path. r=till

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7fe1ee54c97b

Comment 6

[Gerry Chang [:gchang]]

54 RC build is released. Mark 54 won't fix.