[Webkit-unassigned] [Bug 14244] New: Data corruption when using a replace() callback function with data containing "$"

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=14244

           Summary: Data corruption when using a replace() callback function
                    with data containing "$"
           Product: WebKit
           Version: 522+ (nightly)
          Platform: PC
               URL: http://blog.stevenlevithan.com/javascript/commafy-
                    numbers/
        OS/Version: Windows XP
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: steves_list at hotmail.com


When using a function for the replacement argument with the String.replace()
method, the returned data is somehow returned incorrectly if it contains a
dollar sign ("$") followed by a number for which there is a corresponding
capturing group in the regular expression pattern being searched for. This
corruption does not directly result from the regular expression or any other
JavaScript code being run over the data.

Here's reduced code to reproduce the bug:

var str = '$1';
alert(str.replace(/(\D)(\d)/g, function($0){return $0;}));

Values to set for str, and the results:

- '$1' (as shown above) incorrectly returns just $.
- '$2' incorrectly returns just 2.
- Other values correctly result in the entire, original test string being
returned.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.