Fix string position calculation in @@replace (#3831)

Fixes #3817.

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai@inf.u-szeged.hu

Author: dbatyai

jerry-core/ecma/operations/ecma-regexp-object.c

@@ -3115,7 +3115,22 @@ ecma_regexp_replace_helper (ecma_value_t this_arg, /**< this argument */
                                     (lit_utf8_size_t) (match_position_p - source_position_p));
       replace_ctx.match_byte_pos = (lit_utf8_size_t) (match_position_p - replace_ctx.string_p);
 
-      source_position_p = JERRY_MIN (match_position_p + matched_str_size, string_end_p);
+      if ((string_flags & ECMA_STRING_FLAG_IS_ASCII) && matched_str_size == matched_str_length)
+      {
+        source_position_p = JERRY_MIN (match_position_p + matched_str_size, string_end_p);
+      }
+      else
+      {
+        lit_utf8_size_t code_unit_count = matched_str_length;
+
+        while (code_unit_count-- > 0 && JERRY_LIKELY (match_position_p < string_end_p))
+        {
+          lit_utf8_incr (&match_position_p);
+        }
+
+        source_position_p = match_position_p;
+      }
+
       replace_ctx.index = JERRY_MIN (position + matched_str_length, string_length);
     }
 

tests/jerry/es2015/regression-test-issue-3817.js

@@ -0,0 +1,16 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var replace = RegExp.prototype[Symbol.replace];
+replace.call({ exec : ( ) => { return {  } } }, '^o𓙦һ', "a");

tests/jerry/es2015/symbol-replace.js

@@ -621,6 +621,10 @@ try {
   assert (e instanceof TypeError);
 }
 
+assert(replace.call({ exec : ( ) => { return {  } } }, 'һ', "a") === "a");
+assert(replace.call({ exec : ( ) => { return {  } } }, 'һһһһһһһһһ', "a") === "a");
+assert(replace.call({ exec : ( ) => { return {  } } }, 'һһһһһһһһһһ', "a") === "aһ");
+
 /* Object with custom @@replace method */
 var o = {}
 o[Symbol.replace] = function () {