Fix creating substring in string.replace(<global regexp>, <function>).

BUG=
TEST=regexp-global.js

Review URL: https://chromiumcodereview.appspot.com/10454032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11661 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -3955,7 +3955,6 @@ static int SearchRegExpMultiple(
             match = isolate->factory()->NewSubString(subject,
                                                      match_start,
                                                      match_end);
-            first = false;
           }
           elements->set(0, *match);
           for (int i = 1; i <= capture_count; i++) {
@@ -3963,8 +3962,14 @@ static int SearchRegExpMultiple(
             if (start >= 0) {
               int end = current_match[i * 2 + 1];
               ASSERT(start <= end);
-              Handle<String> substring =
+              Handle<String> substring;
+              if (!first) {
+                substring =
                     isolate->factory()->NewProperSubString(subject, start, end);
+              } else {
+                substring =
+                    isolate->factory()->NewSubString(subject, start, end);
+              }
               elements->set(i, *substring);
             } else {
               ASSERT(current_match[i * 2 + 1] < 0);
@@ -3975,6 +3980,7 @@ static int SearchRegExpMultiple(
           elements->set(capture_count + 2, *subject);
           builder->Add(*isolate->factory()->NewJSArrayWithElements(elements));
         }
+        first = false;
       }
 
       // If we did not get the maximum number of matches, we can stop here

test/mjsunit/regexp-global.js

@@ -125,3 +125,8 @@ str = str.replace(/(FOUR|TWO) \u817f (GOOD|BAD)/g,
                     return match.length - 7;
                   });
 assertEquals("4, 2!", str);
+
+// Test capture that is a real substring.
+var str = "Beasts of England, beasts of Ireland";
+str = str.replace(/(.*)/g, function(match) { return '~'; });
+assertEquals("~~");