Fix string replacement with invalid captures

If we have a theoretically valid capture reference that just didn't
capture anything in this match, we don't want to treat it as literal.
Only capture references that clearly are outside the range of things we
can possibly capture with this expression should be treated as literal
strings.

Change-Id: Iab0bf329d11a6b9e172aa662f11751d86cfc26a6
Fixes: QTBUG-75121
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

1 files changed, 1 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4stringobject.cpp b/src/qml/jsruntime/qv4stringobject.cpp
index dee6a67792..6afa6d36d6 100644
--- a/src/qml/jsruntime/qv4stringobject.cpp
+++ b/src/qml/jsruntime/qv4stringobject.cpp
@@ -765,9 +765,8 @@ static void appendReplacementString(QString *result, const QString &input, const
             i += skip;
             if (substStart != JSC::Yarr::offsetNoMatch && substEnd != JSC::Yarr::offsetNoMatch)
                 *result += input.midRef(substStart, substEnd - substStart);
-            else {
+            else if (skip == 0) // invalid capture reference. Taken as literal value
                 *result += replaceValue.at(i);
-            }
         } else {
             *result += replaceValue.at(i);
         }