stringProtoFuncReplace() ends up calling substituteBackRef() in the same file which converts 8 bit strings to 16 bit strings creating a 16 bit result. This was found running the dromaeo tests.
Created attachment 123204 [details] Patch
Comment on attachment 123204 [details] Patch r=me
Committed r106257: <http://trac.webkit.org/changeset/106257>