21.2.5.7 RegExp.prototype.replace ( string, replaceValue )
21.2.5.2.1 Runtime Semantics: RegExpExec Abstract Operation
The dynamic regular expression flags retrieval with Get() is unsafe when it is performed multiple times, like in RegExp.prototype.replace().
Multiple solutions are possible:
- retrieve flags only once with Get()
- retrieve flags with internal [[OriginalFlags]] field
- change 21.2.5.7, step 16.d.xv to handle the case when nextSrcPosition > position
Expected: No error
Actual: Attempt to retrieve substring [start=8, end=0]
Test case:
---
var re = /test/;
var glob = true;
var c = 0;
Object.defineProperty(re, "global", {
get() {
c += 1;
if (c == 3) {
re.compile(/pre/);
}
if (c == 4) {
re.compile(/kaboom/);
}
var g = glob;
glob = false;
return g;
}
});
"pre-test".replace(re, function(){});
---
fixed in rev24 editor's draft.
Took the third alternative as subclasses could (either intentionally or unintentionally) also cause the position to move backs words changing the RegExp match algorithm it uses.
fixed in rev24