Fix creating substring in string.replace(<global regexp>, <function>).

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index af9cef575b5a96c46062520aec63226241151c7c..d18a158c44d0442eb42ec67c5bea514031c15b48 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -3955,7 +3955,6 @@ static int SearchRegExpMultiple(
             match = isolate->factory()->NewSubString(subject,
                                                      match_start,
                                                      match_end);
-            first = false;
           }
           elements->set(0, *match);
           for (int i = 1; i <= capture_count; i++) {
@@ -3963,8 +3962,14 @@ static int SearchRegExpMultiple(
             if (start >= 0) {
               int end = current_match[i * 2 + 1];
               ASSERT(start <= end);
-              Handle<String> substring =
-                  isolate->factory()->NewProperSubString(subject, start, end);
+              Handle<String> substring;
+              if (!first) {

[Lasse Reichstein Nielsen, 2012/05/29 09:06:52]

Perhaps drop "first" and just check if start > 0 here.
Or, alternatively, just call NewSubString every time. I bet it starts checking
whether  start == 0  anyway, so removing the test here makes up for that.

+                substring =
+                    isolate->factory()->NewProperSubString(subject, start, end);
+              } else {
+                substring =
+                    isolate->factory()->NewSubString(subject, start, end);
+              }
               elements->set(i, *substring);
             } else {
               ASSERT(current_match[i * 2 + 1] < 0);
@@ -3975,6 +3980,7 @@ static int SearchRegExpMultiple(
           elements->set(capture_count + 2, *subject);
           builder->Add(*isolate->factory()->NewJSArrayWithElements(elements));
         }
+        first = false;
       }
 
       // If we did not get the maximum number of matches, we can stop here