Fix bug in string replace regexp with function when returning non-string.

src/string.js

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 432 matching lines @@
         while (i < len) {
           var elem = res[i];
           if (%_IsSmi(elem)) {
             if (elem > 0) {
               match_start = (elem >> 11) + (elem & 0x7ff);
             } else {
               match_start = res[++i] - elem;
             }
           } else {
             var func_result = replace.call(null, elem, match_start, subject);
-            if (!IS_STRING(func_result)) func_result = TO_STRING(func_result);
+            if (!IS_STRING(func_result)) func_result = NonStringToString(func_result);

[fschneider, 2010/03/29 16:21:47]

Long line.

[Vitaly Repeshko, 2010/03/29 16:52:53]

You can use func_result = TO_STRING_INLINE(func_result). Note: TO_STRING_INLINE
takes a variable.

[Lasse Reichstein, 2010/03/29 18:58:31]

Line wrapped.
Re. TO_STRING_INLINE, I considered it, but it seems wasteful to do the identity
assignment if the result is a string.

             res[i] = func_result;
-            match_start += elem.length; 
+            match_start += elem.length;
           }
           i++;
         }      
       } else {      
         while (i < len) {
           var elem = res[i];
           if (!%_IsSmi(elem)) {
             // elem must be an Array.
             // Use the apply argument as backing for global RegExp properties.
             lastMatchInfoOverride = elem;
             var func_result = replace.apply(null, elem);
-            if (!IS_STRING(func_result)) func_result = TO_STRING(func_result);
+            if (!IS_STRING(func_result)) func_result = NonStringToString(func_result);

[fschneider, 2010/03/29 16:21:47]

Long line.

[Vitaly Repeshko, 2010/03/29 16:52:53]

Same here.

[Lasse Reichstein, 2010/03/29 18:58:31]

Dittos.

             res[i] = func_result;
           }
           i++;
         }
       }
       var result = new ReplaceResultBuilder(subject, res);
       return result.generate();
     } finally {
       lastMatchInfoOverride = null;
       resultArray.length = 0;
@@ skipping 503 matching lines @@
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup,
     "toJSON", StringToJSON
   ));
 }
 
 
 SetupString();