213023 2020-06-10 07:07:02 -0700 An issue about String.prototype.replace 2020-06-12 02:10:54 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build PC Linux RESOLVED DUPLICATE 205785 InRadar P2 Normal --- 1 nisl_grammarly1 ysuzuki ashvayka fpizlo webkit-bug-importer ysuzuki oldest_to_newest 1661147 0 nisl_grammarly1 2020-06-10 07:07:02 -0700 According to ES10.0, "String.prototype.replace(searchValue,replaceValue)" will return a new string which matches of "searchValue" is replaced by "replaceValue". But when "relpaceValue" is a string with "$<" and "searchValue" is "/a/", the result is wrong. This is an issue of "String.prototype.replace". #### version d940b47 #### command webkit/WebKitBuild/Release/bin/jsc testcase.js #### testcase var NISLFuzzingFunc = function(){ var result = "a".replace(/a/,"AAAA$<AAAA"); print(result); }; NISLFuzzingFunc(); #### output $<AAAA #### expected output AAAA$<AAAA Contributor:Yuan Wang 1661812 1 webkit-bug-importer 2020-06-11 18:07:00 -0700 <rdar://problem/64278675> 1661886 2 ashvayka 2020-06-12 02:10:54 -0700 (In reply to NWU_NISL from comment #0) > #### version > d940b47 This appears to be GitHub WebKit mirror commit hash (rather than git-svn): https://github.com/WebKit/webkit/commit/d940b477848884f63752d25491d9dd0b9d3ccb2d, which points to r246052 (Jun 3, 2019). > #### expected output > AAAA$<AAAA The issue was fixed in r254088 (Jan 6, 2020): I've confirmed that JSC outputs expected "AAAA$<AAAA" since this revision, yet "$<AAAA" before it. *** This bug has been marked as a duplicate of bug 205785 ***