Updates to String.prototype.replace doesn't handle $ in replacement value without capture group

[jmmorris]

The recent updates to String.prototype.replace are causing issues when a replacement without a capture group starts with a $.

I was specifically seeing this in Safari 12 but didn't dig in on that front beyond knowing that it wasn't affecting Chrome.

Chrome: '{price} Retail'.replace(/{price}/g, '$25.00') == '$25.00 Retail'
Safari: '{price} Retail'.replace(/{price}/g, '$25.00') == '5.00 Retail'

Version: 2.6.1

[nicolo-ribaudo]

I'll take a look

[dan-kez]

I believe this is an issue still. I've tested with the following:

var url = "https://cdnjs.cloudflare.com/ajax/libs/core-js/2.6.8/core.js";
function loadjs(file) {
            var script = document.createElement("script");
            script.type = "application/javascript";
            script.onload=function(){
                //at this tine the script is loaded
                console.log("Script loaded!");
				console.log(String.prototype.replace)
				console.log('{price} Retail'.replace(/{price}/g, '$25.00'))
            }
            script.src = file;
            document.body.appendChild(script);
        }

loadjs(url);

Safari (In the console this is confirmed to go to the right location:

[Log] Script loaded!
[Log] function replace(searchValue, replaceValue) {
      var O = defined(this);
      var fn = searchValue == undefined ? undefined : searchValue[REPLACE];
      return fn !== undefined
        ? fn.call(searchValue, O, replaceValue)
        : $replace.call(String(O), searchValue, replaceValue);
    }
[Log] 5.00 Retail

[webschik]

Safari behaves differently when RegExp.prototype[@@replace] is used with a replacement text $0-9:

RegExp.prototype[Symbol.replace].call(/{price}/g, '{price} Retail', '$25.00') // Safari - 5.00 Retail
RegExp.prototype[Symbol.replace].call(/{price}/g, '{price} Retail', '$25.00') // FF, Chrome - $25.00  Retail

RegExp.prototype[Symbol.replace].call(/{price}/g, '{price} Retail', '$test') // Safari, FF, Chrome - test Retail

And as I see RegExp.prototype[@@replace] is used in String.prototype.replace polyfill - https://cdnjs.cloudflare.com/ajax/libs/core-js/2.6.8/core.js:1862

It can be fixed by escaping $ with $$ - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/replace#Specifying_a_string_as_a_parameter