1650518 - Invalid String.prototype.replace with string search value: "a>".replace(/>/, "$+") returns "a"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[1059252359]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

var NISLFuzzingFunc = function(e,nislMutationParameter0){
return e.replace(/>/,nislMutationParameter0);
};
var NISLParameter0 = 'a>';
var nislMutationArgument0 = '$+';
var NISLCallingResult = NISLFuzzingFunc(NISLParameter0,nislMutationArgument0);
print(NISLCallingResult);

Actual results:

The output is "a".

Expected results:

The above program should output "a$+".

Comment 1

[André Bargull [:anba]]

$+ is a SpiderMonkey extension.

Comment 2

[Alice0775 White]

I think the '$' character needs to be escaped with $.
"a>".replace(/>/, "$$+")

Comment 3

[Jan de Mooij [:jandem]]

Should we just remove this non-standard extension? It's not even in the MDN docs.

It doesn't seem worth the (probably small, but still) web compat risk.

Comment 4

[André Bargull [:anba]]

We could try to remove this by starting to warn about it. I don't expect any web-sites issues, because we're the only browser supporting this extension, but addons could be affected.

Comment 5

[Jason Orendorff [:jorendorff]]

I vote we just remove it. I'd be surprised if any addons are using this.

RegExp.lastParen and RegExp['$+'] are also nonstandard but documented and widely implemented. They work in Chrome. They can't be removed.

Comment 6

[André Bargull [:anba]]

(In reply to Jason Orendorff [:jorendorff] from comment #5)

RegExp.lastParen and RegExp['$+'] are also nonstandard but documented and widely implemented. They work in Chrome. They can't be removed.

https://github.com/tc39/proposal-regexp-legacy-features, but that proposal isn't super active.

Comment 7

[Tom S]

Attachment: Bug 1650518 - Remove the non-standard String.prototype.replace extension $+. r?jandem

Comment 8

[Tom S]

I agree with Jason from a year ago, just removing this is hopefully fine. Most programs probably won't have catastrophic failures with some unreplaced string.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7b4e64801efa
Remove the non-standard String.prototype.replace extension $+. r=jandem

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/7b4e64801efa