From 1eb9608d64242d0efec199b24f3bdf13063bf88e Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Tue, 1 Oct 2024 01:05:01 +0200
Subject: [PATCH] Fix regexp split with zero-length capture group (#566)

The expected result of `"ab".split(/(c)*/)[1]` is `undefined` but
was in fact `"undefined"` due to unintentional stringification.

Fixes: https://github.com/quickjs-ng/quickjs/issues/565
---
 quickjs.c             | 7 ++++++-
 tests/test_builtin.js | 2 ++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/quickjs.c b/quickjs.c
index 6467667..6774f84 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -43835,9 +43835,14 @@ static JSValue js_regexp_Symbol_split(JSContext *ctx, JSValue this_val,
                 if (js_get_length64(ctx, &numberOfCaptures, z))
                     goto exception;
                 for(i = 1; i < numberOfCaptures; i++) {
-                    sub = JS_ToStringFree(ctx, JS_GetPropertyInt64(ctx, z, i));
+                    sub = JS_GetPropertyInt64(ctx, z, i);
                     if (JS_IsException(sub))
                         goto exception;
+                    if (!JS_IsUndefined(sub)) {
+                        sub = JS_ToStringFree(ctx, sub);
+                        if (JS_IsException(sub))
+                            goto exception;
+                    }
                     if (JS_DefinePropertyValueInt64(ctx, A, lengthA++, sub, JS_PROP_C_W_E | JS_PROP_THROW) < 0)
                         goto exception;
                     if (lengthA == lim)
diff --git a/tests/test_builtin.js b/tests/test_builtin.js
index 411784e..e02a0f7 100644
--- a/tests/test_builtin.js
+++ b/tests/test_builtin.js
@@ -783,6 +783,8 @@ function test_regexp()
     assert(a, ["a", undefined]);
     a = /(?:|[\w])+([0-9])/.exec("123a23");
     assert(a, ["123a23", "3"]);
+    a = "ab".split(/(c)*/);
+    assert(a, ["a", undefined, "b"]);
 }
 
 function test_symbol()