[webkit-reviews] review granted: [Bug 209323] RegExp.prototype[@@replace] doesn't coerce result index to integer : [Attachment 394052] Patch

[bugzilla-daemon at webkit.org]

Yusuke Suzuki <ysuzuki at apple.com> has granted Ross Kirsling
<ross.kirsling at sony.com>'s request for review:
Bug 209323: RegExp.prototype[@@replace] doesn't coerce result index to integer
https://bugs.webkit.org/show_bug.cgi?id=209323

Attachment 394052: Patch

https://bugs.webkit.org/attachment.cgi?id=394052&action=review




--- Comment #2 from Yusuke Suzuki <ysuzuki at apple.com> ---
Comment on attachment 394052
  --> https://bugs.webkit.org/attachment.cgi?id=394052
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=394052&action=review

r=me

> Source/JavaScriptCore/ChangeLog:14
> +	   From https://tc39.es/ecma262/#sec-regexp.prototype-@@replace:
> +	     21.2.5.10 RegExp.prototype [ @@replace ] ( string, replaceValue )
> +	       ...
> +	       14. For each result in results, do
> +		 ...
> +		 e. Let position be ? ToInteger(? Get(result, "index")).
> +		 f. Set position to max(min(position, lengthS), 0).

Can you ensure that we do not need to change DFG / FTL too?