Amends to r9181 and r9191.

src/runtime.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2573 matching lines @@
     int data;
   };
 
   template<typename Char>
   static bool ParseReplacementPattern(ZoneList<ReplacementPart>* parts,
                                       Vector<Char> characters,
                                       int capture_count,
                                       int subject_length) {
     int length = characters.length();
     int last = 0;
-    bool simple = true;
     for (int i = 0; i < length; i++) {
       Char c = characters[i];
       if (c == '$') {
-        simple = false;
         int next_index = i + 1;
         if (next_index == length) {  // No next character!
           break;
         }
         Char c2 = characters[next_index];
         switch (c2) {
         case '$':
           if (i > last) {
             // There is a substring before. Include the first "$".
             parts->Add(ReplacementPart::ReplacementSubString(last, next_index));
@@ skipping 68 matching lines @@
         }
         default:
           i = next_index;
           break;
         }
       }
     }
     if (length > last) {
       if (last == 0) {
         parts->Add(ReplacementPart::ReplacementString());
+        return true;
       } else {
         parts->Add(ReplacementPart::ReplacementSubString(last, length));
       }
     }
-    return simple;
+    return false;
   }
 
   ZoneList<ReplacementPart> parts_;
   ZoneList<Handle<String> > replacement_substrings_;
   bool simple_hint_;
 };
 
 
 void CompiledReplacement::Compile(Handle<String> replacement,
                                   int capture_count,
@@ skipping 170 matching lines @@
     }
   }
 }
 
 
 template<typename ResultSeqString>
 MUST_USE_RESULT static MaybeObject* StringReplaceStringWithString(
     Isolate* isolate,
     Handle<String> subject,
     Handle<JSRegExp> pattern_regexp,
-    Handle<String> replacement = Handle<String>::null()) {
+    Handle<String> replacement) {
   ASSERT(subject->IsFlat());
-  ASSERT(replacement.is_null() || replacement->IsFlat());
+  ASSERT(replacement->IsFlat());
 
   ZoneScope zone_space(isolate, DELETE_ON_EXIT);
   ZoneList<int> indices(8);
+  ASSERT_EQ(JSRegExp::ATOM, pattern_regexp->TypeTag());
   String* pattern =
       String::cast(pattern_regexp->DataAt(JSRegExp::kAtomPatternIndex));
   int subject_len = subject->length();
   int pattern_len = pattern->length();
-  int replacement_len = (replacement.is_null()) ? 0 : replacement->length();
+  int replacement_len = replacement->length();
 
   FindStringIndicesDispatch(isolate, *subject, pattern, &indices, 0xffffffff);
 
   int matches = indices.length();
   if (matches == 0) return *subject;
 
   int result_len = (replacement_len - pattern_len) * matches + subject_len;
   int subject_pos = 0;
   int result_pos = 0;
 
   Handle<ResultSeqString> result;
   if (ResultSeqString::kHasAsciiEncoding) {
     result = Handle<ResultSeqString>::cast(
         isolate->factory()->NewRawAsciiString(result_len));
   } else {
     result = Handle<ResultSeqString>::cast(
         isolate->factory()->NewRawTwoByteString(result_len));
   }
 
   for (int i = 0; i < matches; i++) {
     // Copy non-matched subject content.
-    String::WriteToFlat(*subject,
-                        result->GetChars() + result_pos,
-                        subject_pos,
-                        indices.at(i));
-    result_pos += indices.at(i) - subject_pos;
+    if (subject_pos < indices.at(i)) {
+      String::WriteToFlat(*subject,
+                          result->GetChars() + result_pos,
+                          subject_pos,
+                          indices.at(i));
+      result_pos += indices.at(i) - subject_pos;
+    }
+
     // Replace match.
-
     if (replacement_len > 0) {
       String::WriteToFlat(*replacement,
                           result->GetChars() + result_pos,
                           0,
                           replacement_len);
       result_pos += replacement_len;
     }
 
     subject_pos = indices.at(i) + pattern_len;
   }
-  String::WriteToFlat(*subject,
-                      result->GetChars() + result_pos,
-                      subject_pos,
-                      subject_len);
+  // Add remaining subject content at the end.
+  if (subject_pos < subject_len) {
+    String::WriteToFlat(*subject,
+                        result->GetChars() + result_pos,
+                        subject_pos,
+                        subject_len);
+  }
   return *result;
 }
 
 
 MUST_USE_RESULT static MaybeObject* StringReplaceRegExpWithString(
     Isolate* isolate,
     String* subject,
     JSRegExp* regexp,
     String* replacement,
     JSArray* last_match_info) {
@@ skipping 125 matching lines @@
   ASSERT(subject->IsFlat());
 
   HandleScope handles(isolate);
 
   Handle<String> subject_handle(subject);
   Handle<JSRegExp> regexp_handle(regexp);
 
   // Shortcut for simple non-regexp global replacements
   if (regexp_handle->GetFlags().is_global() &&
       regexp_handle->TypeTag() == JSRegExp::ATOM) {
+    Handle<String> empty_string_handle(HEAP->empty_string());
     if (subject_handle->HasOnlyAsciiChars()) {
       return StringReplaceStringWithString<SeqAsciiString>(
-          isolate, subject_handle, regexp_handle);
+          isolate, subject_handle, regexp_handle, empty_string_handle);
     } else {
       return StringReplaceStringWithString<SeqTwoByteString>(
-          isolate, subject_handle, regexp_handle);
+          isolate, subject_handle, regexp_handle, empty_string_handle);
     }
   }
 
   Handle<JSArray> last_match_info_handle(last_match_info);
   Handle<Object> match = RegExpImpl::Exec(regexp_handle,
                                           subject_handle,
                                           0,
                                           last_match_info_handle);
   if (match.is_null()) return Failure::Exception();
   if (match->IsNull()) return *subject_handle;
@@ skipping 10032 matching lines @@
   } else {
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     isolate->counters()->gc_last_resort_from_js()->Increment();
     isolate->heap()->CollectAllGarbage(false);
   }
 }
 
 
 } }  // namespace v8::internal