591318 - Invalid String.prototype.replace with string search value: "a".replace("$", "\\$") returns "a\$"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Honza Bambas (:mayhemer)]

Expected result is "a".

Also:
"a".replace(".", "\\$")) returns "\$", 
"a".replace("^", "\\$")) returns "\$a"

The first argument is clearly taken as regexp.

This cannot be reproduced with the second argument different from "\\$".

This bug appears in Firefox 4 beta 4, was not present in Firefox 4 beta 3.  I don't have narrower regression range at the moment.


Workaround: "a".replace(/\$/g, "\\$") returns "a" as expected.

Comment 1

[Chris Leary [:cdleary] (not checking bugmail)]

The first argument to the String.prototype.replace is *not* automatically converted to a regular expression, per ECMAScript 5th edition section 15.5.4.11 paragraph two:

"If searchValue is not a regular expression, let searchString be toString(searchValue) and search string for the first occurrence of searchString."

Also see recent bug 587366. Thanks for filing, though!

Comment 2

[Alice0775 White]

No this was fixed by Bug 587366 in range of http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2f01056be931&tochange=0aefd9d484f1

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

Er yeah, whoops... that was the bug we fixed. Thanks for the correction Alice0775 White.