[Webkit-unassigned] [Bug 246274] String.prototype.replace should not take fast path if the pattern is RegExp Object and the lastIndex is not numeric

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=246274

Karl Dubost <karlcow at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |BrowserCompat
                 CC|                            |karlcow at apple.com

--- Comment #1 from Karl Dubost <karlcow at apple.com> ---
Modified to run in the browser console. 

```
for (let i = 0; i < 3000; ++i) {
  let r = /abcd/;
  regexLastIndex = {};
  regexLastIndex.toString = function () {
    console.log(i)
    return "1";
  };
  r.lastIndex = regexLastIndex;
  "test".replace(r, "cons")
}
```

Safari result is random
Both Firefox and Chrome print until 2999.

Tested on macOS 13.0
---
Safari Technology Preview  155           18615.1.7.1
Firefox Nightly            107.0a1       10722.10.4
Google Chrome Canary       108.0.5355.0  5355.0

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20221013/3ebdf0c4/attachment.htm>