RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 12:17:44 +00:00
Code Issues Activity Actions

LibJS: Convert matched regex result to string in Symbol.replace

Browse source 
This would crash on an undefined match (no match), since the matched
result was assumed to be a string (such as on discord.com). The spec
suggests converting it to a string as well:
https://tc39.es/ecma262/#sec-regexp.prototype-@@replace (14#c)
This commit is contained in:
Idan Horowitz 2021-04-17 15:46:19 +03:00 • committed by Linus Groh
parent 358697a32f
commit 6cd318d784
2 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Userland/Libraries/LibJS/Runtime/RegExpPrototype.cpp
View file

@ -346,7 +346,11 @@ JS_DEFINE_NATIVE_FUNCTION(RegExpPrototype::symbol_replace)
size_t result_length = length_of_array_like(global_object, result); size_t result_length = length_of_array_like(global_object, result);
size_t n_captures = result_length == 0 ? 0 : result_length - 1; size_t n_captures = result_length == 0 ? 0 : result_length - 1;
auto matched = result.get(0).value_or(js_undefined()); auto matched_value = result.get(0).value_or(js_undefined());
if (vm.exception())
return {};
auto matched = matched_value.to_string(global_object);
if (vm.exception()) if (vm.exception())
return {}; return {};
@ -387,7 +391,7 @@ JS_DEFINE_NATIVE_FUNCTION(RegExpPrototype::symbol_replace)
if (replace_value.is_function()) { if (replace_value.is_function()) {
MarkedValueList replacer_args(vm.heap()); MarkedValueList replacer_args(vm.heap());
replacer_args.append(matched); replacer_args.append(js_string(vm, matched));
replacer_args.append(move(captures)); replacer_args.append(move(captures));
replacer_args.append(Value(position)); replacer_args.append(Value(position));
replacer_args.append(js_string(vm, string)); replacer_args.append(js_string(vm, string));
@ -416,7 +420,7 @@ JS_DEFINE_NATIVE_FUNCTION(RegExpPrototype::symbol_replace)
builder.append(replacement); builder.append(replacement);
accumulated_result = builder.build(); accumulated_result = builder.build();
next_source_position = position + matched.as_string().string().length(); next_source_position = position + matched.length();
} }
} }

7
Userland/Libraries/LibJS/Tests/builtins/RegExp/RegExp.prototype.exec.js
View file

@ -148,3 +148,10 @@ test("empty character class semantics", () => {
expect(res.length).toBe(1); expect(res.length).toBe(1);
expect(res[0]).toBe("x"); expect(res[0]).toBe("x");
}); });
// #6409
test("undefined match result", () => {
const r = /foo/;
r.exec = () => ({});
expect(r[Symbol.replace]()).toBe("undefined");
});