Bug 668936: Stringify String.prototype.replace's arguments in the right order (r=jwalden)
authorPaul Biggar <pbiggar@mozilla.com>
Fri, 05 Aug 2011 19:28:31 -0700
changeset 73936 1e7cabf5103d84e70477d5a08ac3110ae663477d
parent 73935 56b60d34085734d343994cbec17ac5156ab3351d
child 73937 2ea2772ce148a2a62a1b99eff4912bd9d150851d
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersjwalden
bugs668936
milestone8.0a1
Bug 668936: Stringify String.prototype.replace's arguments in the right order (r=jwalden)
js/src/jsstr.cpp
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -2128,16 +2128,19 @@ JSBool
 js::str_replace(JSContext *cx, uintN argc, Value *vp)
 {
     ReplaceData rdata(cx);
     rdata.str = ThisToStringForStringProto(cx, vp);
     if (!rdata.str)
         return false;
     static const uint32 optarg = 2;
 
+    if (!rdata.g.init(argc, vp))
+        return false;
+
     /* Extract replacement string/function. */
     if (argc >= optarg && js_IsCallable(vp[3])) {
         rdata.lambda = &vp[3].toObject();
         rdata.elembase = NULL;
         rdata.repstr = NULL;
         rdata.dollar = rdata.dollarEnd = NULL;
 
         if (rdata.lambda->isFunction()) {
@@ -2183,19 +2186,16 @@ js::str_replace(JSContext *cx, uintN arg
         /* We're about to store pointers into the middle of our string. */
         JSFixedString *fixed = rdata.repstr->ensureFixed(cx);
         if (!fixed)
             return false;
         rdata.dollarEnd = fixed->chars() + fixed->length();
         rdata.dollar = js_strchr_limit(fixed->chars(), '$', rdata.dollarEnd);
     }
 
-    if (!rdata.g.init(argc, vp))
-        return false;
-
     /*
      * Unlike its |String.prototype| brethren, |replace| doesn't convert
      * its input to a regular expression. (Even if it contains metachars.)
      *
      * However, if the user invokes our (non-standard) |flags| argument
      * extension then we revert to creating a regular expression. Note that
      * this is observable behavior through the side-effect mutation of the
      * |RegExp| statics.