[Webkit-unassigned] [Bug 213023] New: An issue about String.prototype.replace

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=213023

            Bug ID: 213023
           Summary: An issue about String.prototype.replace
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: nisl_grammarly1 at 163.com

According to ES10.0, "String.prototype.replace(searchValue,replaceValue)" will return a new string which matches of "searchValue" is replaced by "replaceValue". But when "relpaceValue" is a string with "$<" and "searchValue" is "/a/", the result is wrong. This is an issue of "String.prototype.replace".

#### version
d940b47


#### command
webkit/WebKitBuild/Release/bin/jsc testcase.js


#### testcase
var NISLFuzzingFunc = function(){
    var result = "a".replace(/a/,"AAAA$<AAAA");
    print(result);
};
NISLFuzzingFunc();


#### output
$<AAAA


#### expected output
AAAA$<AAAA


Contributor:Yuan Wang

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200610/917f5fb9/attachment-0001.htm>