Fix bug in string replace with nonparticipating captures.

Review URL: http://codereview.chromium.org/1565004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4322 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -3357,11 +3357,16 @@ static RegExpImpl::IrregexpResult SearchRegExpMultiple(
                                                 match_start,
                                                 match_end));
         for (int i = 1; i <= capture_count; i++) {
-          Handle<String> substring =
-              Factory::NewSubString(subject,
-                                    register_vector[i * 2],
-                                    register_vector[i * 2 + 1]);
+          int start = register_vector[i * 2];
+          if (start >= 0) {
+            int end = register_vector[i * 2 + 1];
+            ASSERT(start <= end);
+            Handle<String> substring = Factory::NewSubString(subject, start, end);
             elements->set(i, *substring);
+          } else {
+            ASSERT(register_vector[i * 2 + 1] < 0);
+            elements->set(i, Heap::undefined_value());
+          }
         }
         elements->set(capture_count + 1, Smi::FromInt(match_start));
         elements->set(capture_count + 2, *subject);

test/mjsunit/string-replace.js

@@ -188,3 +188,6 @@ replaceTest("string 42", "string x", /[xy]/, function() { return 42; });
 replaceTest("string true", "string x", /x/g, function() { return true; });
 replaceTest("string null", "string x", /x/g, function() { return null; });
 replaceTest("string undefined", "string x", /x/g, function() { return undefined; });
+
+replaceTest("aundefinedbundefinedcundefined", 
+            "abc", /(.)|(.)/g, function(m, m1, m2, i, s) { return m1+m2; });