- fixed 3098356 - Hard hang on movie search at www.movietickets.com

        * kjs/string_object.cpp:
        (StringProtoFuncImp::call): When doing a regexp replacement that
	results in an empty match, always move on to the next character
	after doing the replacement. The previous code would hit an
	infinite loop if an initial empty match was replaced with the
	empty string.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@2849 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore/ChangeLog

+2002-11-24  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3098356 - Hard hang on movie search at www.movietickets.com
+	
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): When doing a regexp replacement that
+	results in an empty match, always move on to the next character
+	after doing the replacement. The previous code would hit an
+	infinite loop if an initial empty match was replaced with the
+	empty string.
+
 2002-11-24  Maciej Stachowiak  <mjs@apple.com>
 
 	- fixed 3095446 - Crash on AppleScript page due to very long argument list

JavaScriptCore/ChangeLog-2002-12-03

+2002-11-24  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3098356 - Hard hang on movie search at www.movietickets.com
+	
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): When doing a regexp replacement that
+	results in an empty match, always move on to the next character
+	after doing the replacement. The previous code would hit an
+	infinite loop if an initial empty match was replaced with the
+	empty string.
+
 2002-11-24  Maciej Stachowiak  <mjs@apple.com>
 
 	- fixed 3095446 - Crash on AppleScript page due to very long argument list

JavaScriptCore/ChangeLog-2003-10-25

+2002-11-24  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3098356 - Hard hang on movie search at www.movietickets.com
+	
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): When doing a regexp replacement that
+	results in an empty match, always move on to the next character
+	after doing the replacement. The previous code would hit an
+	infinite loop if an initial empty match was replaced with the
+	empty string.
+
 2002-11-24  Maciej Stachowiak  <mjs@apple.com>
 
 	- fixed 3095446 - Crash on AppleScript page due to very long argument list

JavaScriptCore/kjs/string_object.cpp

@@ -298,12 +298,6 @@ Value StringProtoFuncImp::call(ExecState *exec, Object &thisObj, const List &arg
         if (pos == -1)
           break;
         len = mstr.size();
-        // special case of empty match
-        if (len == 0 && lastIndex > 0) {
-          pos = lastIndex + 1;
-          if (pos > u.size())
-            break;
-        }
         UString rstr(u3);
         bool ok;
         // check if u3 matches $1 or $2 etc
@@ -325,6 +319,13 @@ Value StringProtoFuncImp::call(ExecState *exec, Object &thisObj, const List &arg
         lastIndex = pos + rstr.size();
         u = u.substr(0, pos) + rstr + u.substr(pos + len);
         //fprintf(stderr,"pos=%d,len=%d,lastIndex=%d,u=%s\n",pos,len,lastIndex,u.ascii());
+
+        // special case of empty match
+        if (len == 0) {
+          lastIndex = lastIndex + 1;
+          if (lastIndex > u.size())
+            break;
+        }
       } while (global);
 
       result = String(u);