843006 - Incorrect implementation of string.replace() with characters "$01" to "$09"

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Library, defect)

Description

[Memmie Lenglet]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130212082553

Steps to reproduce:

"firstCapture".replace(/(firstCapture)/g, "$01");



Actual results:

It's return "firstCapture1"


Expected results:

It's return "firstCapture"

The bug come from RegExpObject.cpp http://hg.mozilla.org/tamarin-central/file/fbecf6c8a86f/core/RegExpObject.cpp#l550 :
ptr += (i >= 10) ? 3 : 2;
when "i" is less than 10, then it shift 2 chars, but it's could also 3: "$1" <=> "$01"

Comment 1

[Sylvestre Ledru [:Sylvestre]]

Tamarin is a dead project now. Mass WONTFIX.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.