Changeset 90247 in webkit for trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp

Timestamp:

Jul 1, 2011, 11:19:17 AM (14 years ago)

Author:

[email protected]

Message:

​https://bugs.webkit.org/show_bug.cgi?id=63819
Escaping of forwardslashes in strings incorrect if multiple exist.

Reviewed by Sam Weinig.

Source/JavaScriptCore:

The bug is in the parameters passed to a substring - should be
start & length, but we're passing start & end indices!

• runtime/RegExpObject.cpp:

(JSC::regExpObjectSource):

LayoutTests:

Add tests with multiple forward slashes.

• fast/regex/script-tests/toString.js:
• fast/regex/toString-expected.txt:

File:

• trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp

@@ -135 +135 @@
         // double escape it.
         if ((forwardSlashPosition - slashesPosition) & 1)
-            result.append(pattern.substringSharingImpl(completed, forwardSlashPosition + 1));
+            result.append(pattern.substringSharingImpl(completed, forwardSlashPosition - completed + 1));
         else {
-            result.append(pattern.substringSharingImpl(completed, forwardSlashPosition));
+            result.append(pattern.substringSharingImpl(completed, forwardSlashPosition - completed));
             result.append("\\/");
         }