@@ -773,11 +773,8 @@ namespace Js
773773 {
774774 // We've found a substitution ref, like $32. In accordance with the standard (sec-getsubstitution),
775775 // we recognize at most two decimal digits after the dollar sign.
776-
777- // This should be unsigned, but this would cause lots of compiler warnings unless we also make
778- // numGroups unsigned, because of a comparison below.
779- int captureIndex = (int )(currentChar - _u (' 0' ));
780- Assert (0 <= captureIndex && captureIndex <= 9 ); // numeric value of single decimal digit
776+ uint16 captureIndex = (uint16)(currentChar - _u (' 0' ));
777+ Assert (captureIndex < 10 ); // numeric value of single decimal digit
781778
782779 offset = substitutionOffset + 2 ;
783780
@@ -786,9 +783,8 @@ namespace Js
786783 currentChar = replaceStr[substitutionOffset + 2 ];
787784 if (currentChar >= _u (' 0' ) && currentChar <= _u (' 9' ))
788785 {
789- // Should also be unsigned; see captureIndex above.
790- int tempCaptureIndex = (10 * captureIndex) + (int )(currentChar - _u (' 0' ));
791- Assert (0 <= tempCaptureIndex && tempCaptureIndex < 100 ); // numeric value of 2-digit positive decimal number
786+ uint16 tempCaptureIndex = (10 * captureIndex) + (uint16)(currentChar - _u (' 0' ));
787+ Assert (tempCaptureIndex < 100 ); // numeric value of 2-digit positive decimal number
792788 if (tempCaptureIndex < numGroups)
793789 {
794790 captureIndex = tempCaptureIndex;
@@ -797,7 +793,7 @@ namespace Js
797793 }
798794 }
799795
800- Assert (0 <= captureIndex && captureIndex < 100 ); // as above, value of 2-digit positive decimal number
796+ Assert (captureIndex < 100 ); // as above, value of 2-digit positive decimal number
801797 if (captureIndex < numGroups && (captureIndex != 0 ))
802798 {
803799 Var group = getGroup (captureIndex, nonMatchValue);
@@ -1261,12 +1257,13 @@ namespace Js
12611257 JavascriptString* newString = nullptr ;
12621258 const char16* inputStr = input->GetString ();
12631259 CharCount inputLength = input->GetLength ();
1264- const int rawNumGroups = pattern->NumGroups ();
1260+ const uint16 numGroups = pattern->NumGroups ();
12651261 Var nonMatchValue = NonMatchValue (scriptContext, false );
12661262 UnifiedRegex::GroupInfo lastMatch; // initially undefined
12671263
1268- AssertOrFailFast (0 < rawNumGroups && rawNumGroups <= INT16_MAX );
1269- const uint16 numGroups = uint16 (rawNumGroups);
1264+ // Regex parser should ensure this condition holds, but let's be doubly sure.
1265+ // numGroups is always positive because the entire regex counts as a capturing group.
1266+ AssertOrFailFast (0 < numGroups && numGroups <= INT16_MAX );
12701267
12711268#if ENABLE_REGEX_CONFIG_OPTIONS
12721269 RegexHelperTrace (scriptContext, UnifiedRegex::RegexStats::Replace, regularExpression, input, scriptContext->GetLibrary ()->CreateStringFromCppLiteral (_u (" <replace function>" )));
0 commit comments