353041 - JS: String.replace has bug handling substrings with ' and $

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[qomo.team]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; zh-cn) AppleWebKit/418.8 (KHTML, like Gecko) Safari/419.3
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7

try this simple testcase

<script>
var v1 = "$from$";
var v2 = "'txt=$to$';";
alert(v1.replace("$from$", v2));
</script>

this should result 'txt=$to$';
but 'txt=$to$; in every Gecko engine till now

Reproducible: Always

Comment 1

[qomo.team]

Attachment: testcase(same as what in comment)

Comment 2

[Dave Townsend [:mossop]]

According to the JS spec, $' in the replacement string equates to the portion of the source string after the matched part. To avoid this you would use "'txt=$to$$';" for the replacement string.