<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>14244</bug_id>
          
          <creation_ts>2007-06-20 13:42:40 -0700</creation_ts>
          <short_desc>Data corruption when using a replace() callback function with data containing &quot;$&quot;</short_desc>
          <delta_ts>2007-06-20 17:00:36 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>523.x (Safari 3)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>Windows XP</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://blog.stevenlevithan.com/javascript/commafy-numbers/</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Steven Levithan">steves_list</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>mrowe</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>7013</commentid>
    <comment_count>0</comment_count>
    <who name="Steven Levithan">steves_list</who>
    <bug_when>2007-06-20 13:42:40 -0700</bug_when>
    <thetext>When using a function for the replacement argument with the String.replace() method, the returned data is somehow returned incorrectly if it contains a dollar sign (&quot;$&quot;) followed by a number for which there is a corresponding capturing group in the regular expression pattern being searched for. This corruption does not directly result from the regular expression or any other JavaScript code being run over the data.

Here&apos;s reduced code to reproduce the bug:

var str = &apos;$1&apos;;
alert(str.replace(/(\D)(\d)/g, function($0){return $0;}));

Values to set for str, and the results:

- &apos;$1&apos; (as shown above) incorrectly returns just $.
- &apos;$2&apos; incorrectly returns just 2.
- Other values correctly result in the entire, original test string being returned.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>6998</commentid>
    <comment_count>1</comment_count>
      <attachid>15146</attachid>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-06-20 14:18:56 -0700</bug_when>
    <thetext>Created attachment 15146
Test case</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>6999</commentid>
    <comment_count>2</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-06-20 14:19:35 -0700</bug_when>
    <thetext>Confirmed.  I can reproduce this on Safari 2.0.r and 3 beta on Mac.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>7000</commentid>
    <comment_count>3</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-06-20 14:21:24 -0700</bug_when>
    <thetext>I have a fix for this in my tree, I just need to write up some test cases to better cover the expected behaviours.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>6980</commentid>
    <comment_count>4</comment_count>
      <attachid>15149</attachid>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-06-20 16:23:14 -0700</bug_when>
    <thetext>Created attachment 15149
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>6981</commentid>
    <comment_count>5</comment_count>
      <attachid>15149</attachid>
    <who name="">mitz</who>
    <bug_when>2007-06-20 16:43:47 -0700</bug_when>
    <thetext>Comment on attachment 15149
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>6973</commentid>
    <comment_count>6</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-06-20 17:00:36 -0700</bug_when>
    <thetext>Landed in r23675.  Thanks for the bug report!</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>15146</attachid>
            <date>2007-06-20 14:18:56 -0700</date>
            <delta_ts>2007-06-20 14:18:56 -0700</delta_ts>
            <desc>Test case</desc>
            <filename>bug-14244-test.html</filename>
            <type>text/html</type>
            <size>334</size>
            <attacher name="Mark Rowe (bdash)">mrowe</attacher>
            
              <data encoding="base64">PGh0bWw+CjxoZWFkPgo8dGl0bGU+VGVzdCBQYWdlPC90aXRsZT4KPC9oZWFkPgo8Ym9keT4KPHNj
cmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgpmdW5jdGlvbiByZXBsYWNlRnVuY3Rpb24oYSkg
ewogICAgcmV0dXJuICIkMSI7Cn0KdmFyIHN0ciA9ICJUaGlzIGlzIHNvbWUgdGV4dC4iOwp2YXIg
cmVzdWx0ID0gc3RyLnJlcGxhY2UoLyguKikvZywgcmVwbGFjZUZ1bmN0aW9uKTsKZG9jdW1lbnQu
d3JpdGUoIkV4cGVjdGVkIHJlc3VsdDogJDEkMTxicj4iKTsKZG9jdW1lbnQud3JpdGUoIkFjdHVh
bCByZXN1bHQ6ICIgKyByZXN1bHQpOwo8L3NjcmlwdD4KPC9ib2R5Pgo8L2h0bWw+Cg==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>15149</attachid>
            <date>2007-06-20 16:23:14 -0700</date>
            <delta_ts>2007-06-20 16:43:47 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>webkit-bug-14244-v1.patch</filename>
            <type>text/plain</type>
            <size>5510</size>
            <attacher name="Mark Rowe (bdash)">mrowe</attacher>
            
              <data encoding="base64">SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIzNjY0KQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl
TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMDctMDYtMjAgIE1hcmsgUm93
ZSAgPG1yb3dlQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh
KS4KKworICAgICAgICBGaXggaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9
MTQyNDQKKyAgICAgICAgQnVnIDE0MjQ0OiBEYXRhIGNvcnJ1cHRpb24gd2hlbiB1c2luZyBhIHJl
cGxhY2UoKSBjYWxsYmFjayBmdW5jdGlvbiB3aXRoIGRhdGEgY29udGFpbmluZyAiJCIKKworICAg
ICAgICAqIGtqcy9zdHJpbmdfb2JqZWN0LmNwcDoKKyAgICAgICAgKEtKUzo6cmVwbGFjZSk6ICBX
aGVuICdyZXBsYWNlbWVudCcgaXMgYSBmdW5jdGlvbiwgZG8gbm90IHJlcGxhY2UgJG4gcGxhY2Vo
b2xkZXJzIGluIGl0cyByZXR1cm4gdmFsdWUuCisgICAgICAgIFRoaXMgbWF0Y2hlcyB0aGUgYmVo
YXZpb3VyIGRlc2NyaWJlZCBpbiBFQ01BIDI2MiAzcmQgRWQgc2VjdGlvbiAxNS41LjQuMSwgYW5k
IGFzIGltcGxlbWVudGVkIGluIEZpcmVmb3guCisKIDIwMDctMDYtMTQgIEFuZGVycyBDYXJsc3Nv
biAgPGFuZGVyc2NhQGFwcGxlLmNvbT4KIAogICAgICAgICBGaXggV2luZG93cyBidWlsZC4KSW5k
ZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9zdHJpbmdfb2JqZWN0LmNwcAo9PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBK
YXZhU2NyaXB0Q29yZS9ranMvc3RyaW5nX29iamVjdC5jcHAJKHJldmlzaW9uIDIzNjUyKQorKysg
SmF2YVNjcmlwdENvcmUva2pzL3N0cmluZ19vYmplY3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0z
NDQsMjcgKzM0NCwyOCBAQCBzdGF0aWMgSlNWYWx1ZSAqcmVwbGFjZShFeGVjU3RhdGUgKmV4ZWMs
CiAKICAgICAgIHB1c2hTb3VyY2VSYW5nZShzb3VyY2VSYW5nZXMsIHNvdXJjZVJhbmdlQ291bnQs
IHNvdXJjZVJhbmdlQ2FwYWNpdHksIFVTdHJpbmc6OlJhbmdlKGxhc3RJbmRleCwgbWF0Y2hJbmRl
eCAtIGxhc3RJbmRleCkpOwogCisgICAgICBVU3RyaW5nIHN1YnN0aXR1dGVkUmVwbGFjZW1lbnQ7
CiAgICAgICBpZiAocmVwbGFjZW1lbnRGdW5jdGlvbikgewogICAgICAgICAgIGludCBjb21wbGV0
ZU1hdGNoU3RhcnQgPSBvdmVjdG9yWzBdOwogICAgICAgICAgIExpc3QgYXJnczsKIAogICAgICAg
ICAgIGFyZ3MuYXBwZW5kKGpzU3RyaW5nKG1hdGNoU3RyaW5nKSk7Ci0gICAgICAgICAgCisKICAg
ICAgICAgICBmb3IgKHVuc2lnbmVkIGkgPSAwOyBpIDwgcmVnLT5zdWJQYXR0ZXJucygpOyBpKysp
IHsKICAgICAgICAgICAgICAgaW50IG1hdGNoU3RhcnQgPSBvdmVjdG9yWyhpICsgMSkgKiAyXTsK
ICAgICAgICAgICAgICAgaW50IG1hdGNoTGVuID0gb3ZlY3RvclsoaSArIDEpICogMiArIDFdIC0g
bWF0Y2hTdGFydDsKLSAgICAgICAgICAgICAgCisKICAgICAgICAgICAgICAgYXJncy5hcHBlbmQo
anNTdHJpbmcoc291cmNlLnN1YnN0cihtYXRjaFN0YXJ0LCBtYXRjaExlbikpKTsKICAgICAgICAg
ICB9CiAgICAgICAgICAgCiAgICAgICAgICAgYXJncy5hcHBlbmQoanNOdW1iZXIoY29tcGxldGVN
YXRjaFN0YXJ0KSk7CiAgICAgICAgICAgYXJncy5hcHBlbmQoanNTdHJpbmcoc291cmNlKSk7CiAK
LSAgICAgICAgICByZXBsYWNlbWVudFN0cmluZyA9IHJlcGxhY2VtZW50RnVuY3Rpb24tPmNhbGwo
ZXhlYywgZXhlYy0+ZHluYW1pY0ludGVycHJldGVyKCktPmdsb2JhbE9iamVjdCgpLCAKLSAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXJncykt
PnRvU3RyaW5nKGV4ZWMpOwotICAgICAgfQotICAgICAgCi0gICAgICBVU3RyaW5nIHN1YnN0aXR1
dGVkUmVwbGFjZW1lbnQgPSBzdWJzdGl0dXRlQmFja3JlZmVyZW5jZXMocmVwbGFjZW1lbnRTdHJp
bmcsIHNvdXJjZSwgb3ZlY3RvciwgcmVnKTsKKyAgICAgICAgICBzdWJzdGl0dXRlZFJlcGxhY2Vt
ZW50ID0gcmVwbGFjZW1lbnRGdW5jdGlvbi0+Y2FsbChleGVjLCBleGVjLT5keW5hbWljSW50ZXJw
cmV0ZXIoKS0+Z2xvYmFsT2JqZWN0KCksIAorICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFyZ3MpLT50b1N0cmluZyhleGVjKTsKKyAg
ICAgIH0gZWxzZQorICAgICAgICAgIHN1YnN0aXR1dGVkUmVwbGFjZW1lbnQgPSBzdWJzdGl0dXRl
QmFja3JlZmVyZW5jZXMocmVwbGFjZW1lbnRTdHJpbmcsIHNvdXJjZSwgb3ZlY3RvciwgcmVnKTsK
KwogICAgICAgcHVzaFJlcGxhY2VtZW50KHJlcGxhY2VtZW50cywgcmVwbGFjZW1lbnRDb3VudCwg
cmVwbGFjZW1lbnRDYXBhY2l0eSwgc3Vic3RpdHV0ZWRSZXBsYWNlbWVudCk7CiAKICAgICAgIGxh
c3RJbmRleCA9IG1hdGNoSW5kZXggKyBtYXRjaExlbjsKSW5kZXg6IExheW91dFRlc3RzL0NoYW5n
ZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDIzNjY0
KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMg
QEAKKzIwMDctMDYtMjAgIE1hcmsgUm93ZSAgPG1yb3dlQGFwcGxlLmNvbT4KKworICAgICAgICBS
ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0IGZvciBodHRwOi8vYnVn
cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDI0NAorICAgICAgICBCdWcgMTQyNDQ6IERh
dGEgY29ycnVwdGlvbiB3aGVuIHVzaW5nIGEgcmVwbGFjZSgpIGNhbGxiYWNrIGZ1bmN0aW9uIHdp
dGggZGF0YSBjb250YWluaW5nICIkIgorCisgICAgICAgICogZmFzdC9qcy9yZXNvdXJjZXMvc3Ry
aW5nLXJlcGxhY2UtMi5qczogVXBkYXRlIHRvIHRlc3Qgd2l0aCAncmVwbGFjZVZhbHVlJyBiZWlu
ZyBhIGZ1bmN0aW9uIHJldHVybmluZyBzdHJpbmdzIHdpdGggIiRuIiBwbGFjZWhvbGRlcnMuCisg
ICAgICAgICogZmFzdC9qcy9zdHJpbmctcmVwbGFjZS0yLWV4cGVjdGVkLnR4dDoKKwogMjAwNy0w
Ni0yMCAgTWl0eiBQZXR0ZWwgIDxtaXR6QHdlYmtpdC5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQg
YnkgQWRlbGUuCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2pzL3N0cmluZy1yZXBsYWNlLTItZXhw
ZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvanMvc3RyaW5nLXJlcGxh
Y2UtMi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDIzNjUyKQorKysgTGF5b3V0VGVzdHMvZmFzdC9q
cy9zdHJpbmctcmVwbGFjZS0yLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtOSw2ICs5
LDkgQEAgUEFTUyB0ZXN0U3RyaW5nLnJlcGxhY2UoL1thZWlvdV0vZ2ksJy0nKQogUEFTUyB0ZXN0
U3RyaW5nLnJlcGxhY2UoL1thZWlvdV0vZ2ksIGZ1bmN0aW9uIENhcGl0YWxpemUocyl7IHJldHVy
biBzLnRvVXBwZXJDYXNlKCk7IH0pIGlzICJJdCdzIHRoRSBFbmQgT2YgdGhFIHdPcmxkIEFzIHdF
IGtuT3cgSXQsIEFuZCBJIGZFRWwgZkluRS4iCiBQQVNTIHRlc3RTdHJpbmcucmVwbGFjZSgvKFth
ZWlvdV0pKFthLXpdKS9nLCBmdW5jdGlvbiBDYXBpdGFsaXplKCl7IHJldHVybiBSZWdFeHAuJDEu
dG9VcHBlckNhc2UoKStSZWdFeHAuJDI7IH0pIGlzICJJdCdzIHRoZSBFbmQgT2YgdGhlIHdPcmxk
IEFzIHdlIGtuT3cgSXQsIEFuZCBJIGZFZWwgZkluZS4iCiBQQVNTIHRlc3RTdHJpbmcucmVwbGFj
ZSgvKFthZWlvdV0pKFthLXpdKS9nLCBmdW5jdGlvbiBDYXBpdGFsaXplKG9yaWcscmUxLHJlMikg
eyByZXR1cm4gcmUxLnRvVXBwZXJDYXNlKCkrcmUyOyB9KSBpcyAiSXQncyB0aGUgRW5kIE9mIHRo
ZSB3T3JsZCBBcyB3ZSBrbk93IEl0LCBBbmQgSSBmRWVsIGZJbmUuIgorUEFTUyB0ZXN0U3RyaW5n
LnJlcGxhY2UoLyguKikvZywgZnVuY3Rpb24gcmVwbGFjZVdpdGhEb2xsYXJzKG1hdGNoR3JvdXAp
IHsgcmV0dXJuICckMSc7IH0pIGlzICIkMSQxIgorUEFTUyB0ZXN0U3RyaW5nLnJlcGxhY2UoLygu
KSguKikvZywgZnVuY3Rpb24gcmVwbGFjZVdpdGhNdWx0aXBsZURvbGxhcnMobWF0Y2hHcm91cCkg
eyByZXR1cm4gJyQxJDInOyB9KSBpcyAiJDEkMiIKK1BBU1MgdGVzdFN0cmluZy5yZXBsYWNlKC8o
LikoLiopLywgZnVuY3Rpb24gY2hlY2tSZXBsYWNlbWVudEFyZ3VtZW50cygpIHsgcmV0dXJuIGFy
Z3VtZW50cy5sZW5ndGg7IH0pIGlzICI1IgogUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1
ZQogCiBURVNUIENPTVBMRVRFCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2pzL3Jlc291cmNlcy9z
dHJpbmctcmVwbGFjZS0yLmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvanMvcmVz
b3VyY2VzL3N0cmluZy1yZXBsYWNlLTIuanMJKHJldmlzaW9uIDIzNjUyKQorKysgTGF5b3V0VGVz
dHMvZmFzdC9qcy9yZXNvdXJjZXMvc3RyaW5nLXJlcGxhY2UtMi5qcwkod29ya2luZyBjb3B5KQpA
QCAtMTUsNSArMTUsOCBAQCBzaG91bGRCZSgidGVzdFN0cmluZy5yZXBsYWNlKC8oW2FlaW91XSko
CiAgICAgICAgICAiXCJJdCdzIHRoZSBFbmQgT2YgdGhlIHdPcmxkIEFzIHdlIGtuT3cgSXQsIEFu
ZCBJIGZFZWwgZkluZS5cIiIpOwogc2hvdWxkQmUoInRlc3RTdHJpbmcucmVwbGFjZSgvKFthZWlv
dV0pKFthLXpdKS9nLCBmdW5jdGlvbiBDYXBpdGFsaXplKG9yaWcscmUxLHJlMikgeyByZXR1cm4g
cmUxLnRvVXBwZXJDYXNlKCkrcmUyOyB9KSIsCiAgICAgICAgICJcIkl0J3MgdGhlIEVuZCBPZiB0
aGUgd09ybGQgQXMgd2Uga25PdyBJdCwgQW5kIEkgZkVlbCBmSW5lLlwiIik7CitzaG91bGRCZSgi
dGVzdFN0cmluZy5yZXBsYWNlKC8oLiopL2csIGZ1bmN0aW9uIHJlcGxhY2VXaXRoRG9sbGFycyht
YXRjaEdyb3VwKSB7IHJldHVybiAnJDEnOyB9KSIsICJcIiQxJDFcIiIpOworc2hvdWxkQmUoInRl
c3RTdHJpbmcucmVwbGFjZSgvKC4pKC4qKS9nLCBmdW5jdGlvbiByZXBsYWNlV2l0aE11bHRpcGxl
RG9sbGFycyhtYXRjaEdyb3VwKSB7IHJldHVybiAnJDEkMic7IH0pIiwgIlwiJDEkMlwiIik7Citz
aG91bGRCZSgidGVzdFN0cmluZy5yZXBsYWNlKC8oLikoLiopLywgZnVuY3Rpb24gY2hlY2tSZXBs
YWNlbWVudEFyZ3VtZW50cygpIHsgcmV0dXJuIGFyZ3VtZW50cy5sZW5ndGg7IH0pIiwgIlwiNVwi
Iik7CiAKIHZhciBzdWNjZXNzZnVsbHlQYXJzZWQgPSB0cnVlOwo=
</data>
<flag name="review"
          id="6244"
          type_id="1"
          status="+"
          setter="mitz"
    />
          </attachment>
      

    </bug>

</bugzilla>