String.prototype.replace() with global regex doesn't resolve correctly $`

[dankox]

Hi, I'm using MuJS version 1.3.2 and I think the String.prototype.replace() doesn't work correctly with global regular expression and replacement pattern "$`". MuJS is using the last found location of the search pattern as a start for the replacement which is preceding the found substring. This also applies to the offset passed to the replacement function parameter.

MuJS version:

> "abcdce".replace(/c/g, " $` ")
"ab ab d d e"
> "abcdce".replace(/c/g, function(match, offset, str) { console.log("offset " + offset); })
offset 2
offset 1
"abundefineddundefinede"

NodeJS version:

> "abcdce".replace(/c/g, " $` ")
'ab ab d abcd e'
> "abcdce".replace(/c/g, function(match, offset, str) { console.log("offset " + offset); })
offset 2
offset 4
'abundefineddundefinede'

I'm not sure if using NodeJS is a good way of verifying the functionality, because I don't know if ES5 had different behaviour defined for this function or not (NodeJS has ES6 support).

If however it is a good way of checking and the error is real, I think it could be solved by this patch:

diff --git a/jsstring.c b/jsstring.c
index 6da9191..d600043 100644
--- a/jsstring.c
+++ b/jsstring.c
@@ -407,12 +407,13 @@ static void Sp_search(js_State *J)
 static void Sp_replace_regexp(js_State *J)
 {
    js_Regexp *re;
-   const char *source, *s, *r;
+   const char *source, *origsource, *s, *r;
    js_Buffer *sb = NULL;
    int n, x;
    Resub m;

    source = checkstring(J, 0);
+   origsource = source;
    re = js_toregexp(J, 1);

    if (js_doregexec(J, re->prog, source, &m, 0)) {
@@ -431,7 +432,7 @@ loop:
        js_pushundefined(J);
        for (x = 0; m.sub[x].sp; ++x) /* arg 0..x: substring and subexps that matched */
            js_pushlstring(J, m.sub[x].sp, m.sub[x].ep - m.sub[x].sp);
-       js_pushnumber(J, s - source); /* arg x+2: offset within search string */
+       js_pushnumber(J, s - origsource); /* arg x+2: offset within search string */
        js_copy(J, 0); /* arg x+3: search string */
        js_call(J, 2 + x);
        r = js_tostring(J, -1);
@@ -447,7 +448,7 @@ loop:
                case 0: --r; /* end of string; back up */
                /* fallthrough */
                case '$': js_putc(J, &sb, '$'); break;
-               case '`': js_putm(J, &sb, source, s); break;
+               case '`': js_putm(J, &sb, origsource, s); break;
                case '\'': js_puts(J, &sb, s + n); break;
                case '&':
                    js_putm(J, &sb, s, s + n);

Maybe there is more to it, but just wanted to provide a starting point.