Bug 23409

Summary: REGRESSION: RegExp 'replace()' function improperly processes '$$'
Product: WebKit Reporter: William J. Edney <bedney>
Component: JavaScriptCoreAssignee: Darin Adler <darin>
Status: RESOLVED FIXED    
Severity: Normal CC: darin
Priority: P2 Keywords: EasyFix, HasReduction, InRadar, Regression
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
A testcase demonstrating how '$$' is broken.
none
patch sam: review+

Description William J. Edney 2009-01-17 17:28:19 PST 
All -

I've attached a testcase that shows that Webkit's JS engine is no longer properly processing '$$' when present in a replace() using a RegExp, where the replacement is a String (in Safari 3.2.X, this is working fine).

Within the replacement String, '$' is used as a metacharacter along with a number or other special character to reference part of a match. Therefore, to output a '$', you need to use '$$'. This should output a single '$'.

But in the latest Webkit builds (I'm using r40000), a '$$' is output when this syntax is used. All other browsers, FF 3.0.X, IE7+, Chrome properly process this (as does Safari as mentioned above).

I've attached a small testcase.

Cheers,

- Bill
Comment 1 William J. Edney 2009-01-17 17:29:33 PST 
Created attachment 26830 [details]
A testcase demonstrating how '$$' is broken.
Comment 2 Mark Rowe (bdash) 2009-01-18 15:46:30 PST 
<rdar://problem/6505723>
Comment 3 Darin Adler 2009-01-19 12:54:58 PST 
Created attachment 26849 [details]
patch
Comment 4 Darin Adler 2009-01-19 15:35:08 PST 
http://trac.webkit.org/changeset/40042
Comment 5 William J. Edney 2009-01-23 13:53:40 PST 
Verified fixed in build 40102.

Thanks guys!

Cheers,

- Bill