<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>205785</bug_id>
          
          <creation_ts>2020-01-05 21:52:51 -0800</creation_ts>
          <short_desc>String.prototype.replace() incorrectly handles named references on RegExp w/o named groups</short_desc>
          <delta_ts>2020-06-12 02:10:54 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=176814</see_also>
    
    <see_also>https://bugs.webkit.org/show_bug.cgi?id=176434</see_also>
    
    <see_also>https://bugs.webkit.org/show_bug.cgi?id=205783</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Minor</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexey Shvayka">ashvayka</reporter>
          <assigned_to name="Alexey Shvayka">ashvayka</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>ews-watchlist</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>nisl_grammarly1</cc>
    
    <cc>ross.kirsling</cc>
    
    <cc>saam</cc>
    
    <cc>tzagallo</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1602943</commentid>
    <comment_count>0</comment_count>
    <who name="Alexey Shvayka">ashvayka</who>
    <bug_when>2020-01-05 21:52:51 -0800</bug_when>
    <thetext>Test case:
  &quot;ab&quot;.replace(/a/, &quot;$&lt;c&gt;$&lt;d&gt;&quot;)

Expected:
  &quot;$&lt;c&gt;$&lt;d&gt;b&quot;

Actual:
  &quot;$&lt;$&lt;d&gt;b&quot;

ECMA262: https://tc39.es/ecma262/#sec-getsubstitution (step 11)
Test262: https://test262.report/browse/built-ins/RegExp/named-groups/string-replace-nocaptures.js</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1602945</commentid>
    <comment_count>1</comment_count>
      <attachid>386812</attachid>
    <who name="Alexey Shvayka">ashvayka</who>
    <bug_when>2020-01-05 22:16:03 -0800</bug_when>
    <thetext>Created attachment 386812
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1603157</commentid>
    <comment_count>2</comment_count>
      <attachid>386812</attachid>
    <who name="Ross Kirsling">ross.kirsling</who>
    <bug_when>2020-01-06 11:20:02 -0800</bug_when>
    <thetext>Comment on attachment 386812
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=386812&amp;action=review

Wow, what an interesting bug.
r=me, but a couple of questions.

&gt; Source/JavaScriptCore/runtime/StringPrototype.cpp:-226
&gt; -                result.append(replacement.substring(i, 2));
&gt; -                offset = i + 2;
&gt; -                advance = 1;

So was this the correct behavior prior to named capture groups? Or is this too associated with https://github.com/tc39/proposal-regexp-named-groups/issues/29?

&gt; Source/JavaScriptCore/runtime/StringPrototype.cpp:-232
&gt; -                // FIXME: https://bugs.webkit.org/show_bug.cgi?id=176434

We should also close the referenced bug, right?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1603185</commentid>
    <comment_count>3</comment_count>
    <who name="Alexey Shvayka">ashvayka</who>
    <bug_when>2020-01-06 11:45:21 -0800</bug_when>
    <thetext>(In reply to Ross Kirsling from comment #2)
&gt; So was this the correct behavior prior to named capture groups? Or is this
&gt; too associated with
&gt; https://github.com/tc39/proposal-regexp-named-groups/issues/29?

No, I believe it wasn&apos;t.
For backwards compatibility, named capture groups leave &quot;$&lt;..&gt;&quot; as-is for a RegExp w/o named groups.

This patch isn&apos;t associated with https://github.com/tc39/proposal-regexp-named-groups/issues/29:
I&apos;ve only removed FIXMEs to avoid submitting another patch.

&gt; We should also close the referenced bug, right?

I&apos;ve just closed https://bugs.webkit.org/show_bug.cgi?id=176434, thank you.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1603288</commentid>
    <comment_count>4</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2020-01-06 14:46:49 -0800</bug_when>
    <thetext>The commit-queue encountered the following flaky tests while processing attachment 386812:

transitions/default-timing-function.html bug 138901 (authors: dino@apple.com and graouts@apple.com)
The commit-queue is continuing to process your patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1603289</commentid>
    <comment_count>5</comment_count>
      <attachid>386812</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2020-01-06 14:47:42 -0800</bug_when>
    <thetext>Comment on attachment 386812
Patch

Clearing flags on attachment: 386812

Committed r254088: &lt;https://trac.webkit.org/changeset/254088&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1603290</commentid>
    <comment_count>6</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2020-01-06 14:47:44 -0800</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1603291</commentid>
    <comment_count>7</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2020-01-06 14:48:20 -0800</bug_when>
    <thetext>&lt;rdar://problem/58355159&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1661887</commentid>
    <comment_count>8</comment_count>
    <who name="Alexey Shvayka">ashvayka</who>
    <bug_when>2020-06-12 02:10:54 -0700</bug_when>
    <thetext>*** Bug 213023 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>386812</attachid>
            <date>2020-01-05 22:16:03 -0800</date>
            <delta_ts>2020-01-06 14:47:42 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-205785-20200106081601.patch</filename>
            <type>text/plain</type>
            <size>4751</size>
            <attacher name="Alexey Shvayka">ashvayka</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyNTQwNDgpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDEyIEBACisyMDIwLTAxLTA1ICBBbGV4ZXkgU2h2YXlrYSAgPHNodmFpa2FsZXNo
QGdtYWlsLmNvbT4KKworICAgICAgICBTdHJpbmcucHJvdG90eXBlLnJlcGxhY2UoKSBpbmNvcnJl
Y3RseSBoYW5kbGVzIG5hbWVkIHJlZmVyZW5jZXMgb24gUmVnRXhwIHcvbyBuYW1lZCBncm91cHMK
KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwNTc4NQor
CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogdGVzdDI2
Mi9leHBlY3RhdGlvbnMueWFtbDogTWFyayAyIHRlc3QgY2FzZXMgYXMgcGFzc2luZy4KKwogMjAy
MC0wMS0wNCAgQWxleGV5IFNodmF5a2EgIDxzaHZhaWthbGVzaEBnbWFpbC5jb20+CiAKICAgICAg
ICAgSlNPTi5wYXJzZSBzaG91bGQgaW5pdGlhbGl6ZSB3cmFwcGVyIG9iamVjdCB3aXRoIFtbRGVm
aW5lT3duUHJvcGVydHldXQpJbmRleDogSlNUZXN0cy90ZXN0MjYyL2V4cGVjdGF0aW9ucy55YW1s
Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT0KLS0tIEpTVGVzdHMvdGVzdDI2Mi9leHBlY3RhdGlvbnMueWFtbAkocmV2aXNp
b24gMjU0MDMyKQorKysgSlNUZXN0cy90ZXN0MjYyL2V4cGVjdGF0aW9ucy55YW1sCSh3b3JraW5n
IGNvcHkpCkBAIC0xMjg1LDkgKzEyODUsNiBAQCB0ZXN0L2J1aWx0LWlucy9SZWdFeHAvbmFtZWQt
Z3JvdXBzL2dyb3VwCiB0ZXN0L2J1aWx0LWlucy9SZWdFeHAvbmFtZWQtZ3JvdXBzL2dyb3Vwcy1v
YmplY3Qtc3ViY2xhc3MuanM6CiAgIGRlZmF1bHQ6ICdUZXN0MjYyRXJyb3I6IEV4cGVjdGVkIFNh
bWVWYWx1ZSjCq2LCuywgwqskPGE+wrspIHRvIGJlIHRydWUnCiAgIHN0cmljdCBtb2RlOiAnVGVz
dDI2MkVycm9yOiBFeHBlY3RlZCBTYW1lVmFsdWUowqtiwrssIMKrJDxhPsK7KSB0byBiZSB0cnVl
JwotdGVzdC9idWlsdC1pbnMvUmVnRXhwL25hbWVkLWdyb3Vwcy9zdHJpbmctcmVwbGFjZS1ub2Nh
cHR1cmVzLmpzOgotICBkZWZhdWx0OiAnVGVzdDI2MkVycm9yOiBFeHBlY3RlZCBTYW1lVmFsdWUo
wqskPHNuZD4kPGZzdD5jZMK7LCDCqyQ8JDxmc3Q+Y2TCuykgdG8gYmUgdHJ1ZScKLSAgc3RyaWN0
IG1vZGU6ICdUZXN0MjYyRXJyb3I6IEV4cGVjdGVkIFNhbWVWYWx1ZSjCqyQ8c25kPiQ8ZnN0PmNk
wrssIMKrJDwkPGZzdD5jZMK7KSB0byBiZSB0cnVlJwogdGVzdC9idWlsdC1pbnMvUmVnRXhwL25h
bWVkLWdyb3Vwcy91bmljb2RlLXByb3BlcnR5LW5hbWVzLmpzOgogICBkZWZhdWx0OiAnU3ludGF4
RXJyb3I6IEludmFsaWQgcmVndWxhciBleHByZXNzaW9uOiBpbnZhbGlkIGdyb3VwIHNwZWNpZmll
ciBuYW1lJwogICBzdHJpY3QgbW9kZTogJ1N5bnRheEVycm9yOiBJbnZhbGlkIHJlZ3VsYXIgZXhw
cmVzc2lvbjogaW52YWxpZCBncm91cCBzcGVjaWZpZXIgbmFtZScKSW5kZXg6IFNvdXJjZS9KYXZh
U2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3Jl
L0NoYW5nZUxvZwkocmV2aXNpb24gMjU0MDMyKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL0No
YW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDIwLTAxLTA1ICBBbGV4
ZXkgU2h2YXlrYSAgPHNodmFpa2FsZXNoQGdtYWlsLmNvbT4KKworICAgICAgICBTdHJpbmcucHJv
dG90eXBlLnJlcGxhY2UoKSBpbmNvcnJlY3RseSBoYW5kbGVzIG5hbWVkIHJlZmVyZW5jZXMgb24g
UmVnRXhwIHcvbyBuYW1lZCBncm91cHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv
c2hvd19idWcuY2dpP2lkPTIwNTc4NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q
UyEpLgorCisgICAgICAgIFRoaXMgcGF0Y2ggZml4ZXMgc3Vic3RpdHV0aW9uIG9mIG5hbWVkIHJl
ZmVyZW5jZXMgYnkgaWdub3JpbmcgIiQ8IiBzZXF1ZW5jZXMKKyAgICAgICAgZm9yIGEgUmVnRXhw
IHdpdGhvdXQgbmFtZWQgY2FwdHVyZSBncm91cHMsIHJlbW92aW5nIHNvbWUgaW5kZXggdHdlYWtp
bmcuCisgICAgICAgIChzdGVwIDExIG9mIGh0dHBzOi8vdGMzOS5lcy9lY21hMjYyLyNzZWMtZ2V0
c3Vic3RpdHV0aW9uKQorCisgICAgICAgIEFsc28gdGhpcyBjaGFuZ2UgcmVtb3ZlcyAyIG9ic29s
ZXRlIEZJWE1FcyByZWdhcmRpbmcgcG9zc2libGUgc3BlYyBjaGFuZ2VzLgorCisgICAgICAgICog
cnVudGltZS9TdHJpbmdQcm90b3R5cGUuY3BwOgorICAgICAgICAoSlNDOjpzdWJzdGl0dXRlQmFj
a3JlZmVyZW5jZXNTbG93KToKKwogMjAyMC0wMS0wMiAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lA
YXBwbGUuY29tPgogCiAgICAgICAgIFtKU0NdIE1hcmtlZEJsb2NrOjpIYW5kbGUgYW5kIEJsb2Nr
RGlyZWN0b3J5IHNob3VsZCBiZSBzaHJ1bmsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9y
dW50aW1lL1N0cmluZ1Byb3RvdHlwZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3Jp
cHRDb3JlL3J1bnRpbWUvU3RyaW5nUHJvdG90eXBlLmNwcAkocmV2aXNpb24gMjU0MDMyKQorKysg
U291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvU3RyaW5nUHJvdG90eXBlLmNwcAkod29ya2lu
ZyBjb3B5KQpAQCAtMjIwLDMxICsyMjAsMTcgQEAgc3RhdGljIE5FVkVSX0lOTElORSB2b2lkIHN1
YnN0aXR1dGVCYWNrcgogICAgICAgICAgICAgYmFja3JlZkxlbmd0aCA9IHNvdXJjZS5sZW5ndGgo
KSAtIGJhY2tyZWZTdGFydDsKICAgICAgICAgfSBlbHNlIGlmIChyZWcgJiYgcmVmID09ICc8Jykg
ewogICAgICAgICAgICAgLy8gTmFtZWQgYmFjayByZWZlcmVuY2UKLSAgICAgICAgICAgIGlmICgh
aGFzTmFtZWRDYXB0dXJlcykgewotICAgICAgICAgICAgICAgIHJlc3VsdC5hcHBlbmQocmVwbGFj
ZW1lbnQuc3Vic3RyaW5nKGksIDIpKTsKLSAgICAgICAgICAgICAgICBvZmZzZXQgPSBpICsgMjsK
LSAgICAgICAgICAgICAgICBhZHZhbmNlID0gMTsKKyAgICAgICAgICAgIGlmICghaGFzTmFtZWRD
YXB0dXJlcykKICAgICAgICAgICAgICAgICBjb250aW51ZTsKLSAgICAgICAgICAgIH0KIAogICAg
ICAgICAgICAgc2l6ZV90IGNsb3NpbmdCcmFja2V0ID0gcmVwbGFjZW1lbnQuZmluZCgnPicsIGkg
KyAyKTsKLSAgICAgICAgICAgIGlmIChjbG9zaW5nQnJhY2tldCA9PSBXVEY6Om5vdEZvdW5kKSB7
Ci0gICAgICAgICAgICAgICAgLy8gRklYTUU6IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df
YnVnLmNnaT9pZD0xNzY0MzQKLSAgICAgICAgICAgICAgICAvLyBDdXJyZW50IHByb3Bvc2VkIHNw
ZWMgY2hhbmdlIHRocm93cyBhIHN5bnRheCBlcnJvciBpbiB0aGlzIGNhc2UuCi0gICAgICAgICAg
ICAgICAgLy8gV2UgaGF2ZSBtYWRlIHRoZSBjYXNlIHRoYXQgaXQgbWFrZXMgbW9yZSBzZW5zZSB0
byB0cmVhdCB0aGlzIGEgbGl0ZXJhbAotICAgICAgICAgICAgICAgIC8vIElmIHRocm93U3ludGF4
RXJyb3IoZ2xvYmFsT2JqZWN0LCBzY29wZSwgIk1pc3NpbmcgY2xvc2luZyAnPicgaW4gcmVwbGFj
ZW1lbnQgdGV4dCIpOworICAgICAgICAgICAgaWYgKGNsb3NpbmdCcmFja2V0ID09IFdURjo6bm90
Rm91bmQpCiAgICAgICAgICAgICAgICAgY29udGludWU7Ci0gICAgICAgICAgICB9CiAKICAgICAg
ICAgICAgIHVuc2lnbmVkIG5hbWVMZW5ndGggPSBjbG9zaW5nQnJhY2tldCAtIGkgLSAyOwogICAg
ICAgICAgICAgdW5zaWduZWQgYmFja3JlZkluZGV4ID0gcmVnLT5zdWJwYXR0ZXJuRm9yTmFtZShy
ZXBsYWNlbWVudC5zdWJzdHJpbmcoaSArIDIsIG5hbWVMZW5ndGgpLnRvU3RyaW5nKCkpOwogCiAg
ICAgICAgICAgICBpZiAoIWJhY2tyZWZJbmRleCB8fCBiYWNrcmVmSW5kZXggPiByZWctPm51bVN1
YnBhdHRlcm5zKCkpIHsKLSAgICAgICAgICAgICAgICAvLyBGSVhNRTogaHR0cHM6Ly9idWdzLndl
YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3NjQzNAotICAgICAgICAgICAgICAgIC8vIFByb3Bv
c2VkIHNwZWMgY2hhbmdlIHRocm93cyBhIHRocm93IHN5bnRheCBlcnJvciBpbiB0aGlzIGNhc2Uu
Ci0gICAgICAgICAgICAgICAgLy8gV2UgaGF2ZSBtYWRlIHRoZSBjYXNlIHRoYXQgYSBub24tZXhp
c3RlbnQgYmFjayByZWZlcmVuY2Ugc2hvdWxkIGJlIHJlcGxhY2VkIHdpdGgKLSAgICAgICAgICAg
ICAgICAvLyBhbmQgZW1wdHkgc3RyaW5nLgotICAgICAgICAgICAgICAgIC8vIHRocm93U3ludGF4
RXJyb3IoZ2xvYmFsT2JqZWN0LCBzY29wZSwgbWFrZVN0cmluZygiUmVwbGFjZW1lbnQgdGV4dCBy
ZWZlcmVuY2VzIG5vbi1leGlzdGVudCBiYWNrcmVmZXJlbmNlIFwiIiArIHJlcGxhY2VtZW50LnN1
YnN0cmluZyhpICsgMiwgbmFtZUxlbmd0aCkudG9TdHJpbmcoKSkpOwogICAgICAgICAgICAgICAg
IGJhY2tyZWZTdGFydCA9IDA7CiAgICAgICAgICAgICAgICAgYmFja3JlZkxlbmd0aCA9IDA7CiAg
ICAgICAgICAgICB9IGVsc2Ugewo=
</data>

          </attachment>
      

    </bug>

</bugzilla>