RegExp: Fix bug with quantified capture groups (mozilla#1845)

Fixes an issue where capture groups in quantified expressions (min ≥ 2) were not cleared between iterations. For example, in /(?:(\2)(\d)){2}/, during the second iteration, \2 incorrectly retained the first iteration's value instead of being reset.

Before:
js>  /(?:(\2)(\d)){2}/.exec("112")
112,1,2

After:
js>  /(?:(\2)(\d)){2}/.exec("112")
11,,1

Author: balajirrao

Diff for: rhino/src/main/java/org/mozilla/javascript/regexp/NativeRegExp.java

@@ -2683,11 +2683,11 @@ && simpleMatch(gData, input, op, program, pc, end, false, false)
                                             startcp,
                                             state.continuationOp,
                                             state.continuationPc);
-                                    int parenCount = getIndex(program, pc);
-                                    int parenIndex = getIndex(program, pc + INDEX_LEN);
-                                    for (int k = 0; k < parenCount; k++) {
-                                        gData.setParens(parenIndex + k, -1, 0);
-                                    }
+                                }
+                                int parenCount = getIndex(program, pc);
+                                int parenIndex = getIndex(program, pc + INDEX_LEN);
+                                for (int k = 0; k < parenCount; k++) {
+                                    gData.setParens(parenIndex + k, -1, 0);
                                 }
                             } while (program[nextpc] == REOP_ENDCHILD);
 

Diff for: rhino/src/test/java/org/mozilla/javascript/tests/NativeRegExpTest.java

@@ -8,6 +8,7 @@
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
+import java.util.function.BiFunction;
 import org.junit.Test;
 import org.mozilla.javascript.Context;
 import org.mozilla.javascript.ScriptableObject;
@@ -700,4 +701,35 @@ public void backwardFlatCaseInsensitiveNoMatch() throws Exception {
         final String script = "var regex = /abc(?<=XYZ)/i;\n" + "'abc'.match(regex);";
         Utils.assertWithAllModes_ES6(null, script);
     }
+
+    @Test
+    public void quantifiedCaptureClearsPreviousCaptures() {
+        // With the pattern /(?:(\2)(\d))*/, the first capture group should be always empty
+        // when used with a quantifier
+        BiFunction<String, String, String> test =
+                (quantifier, input) -> {
+                    return "var regexStr = '(?:(\\\\2)(\\\\d))'\n"
+                            + "function test(quantifier, input) {\n"
+                            + "  var regexp = new RegExp(regexStr + quantifier + '$');\n"
+                            + "  var res = regexp.exec(input);\n"
+                            + "  return res != null && res.length == 3 && res[1] == '' && res[2] != '';\n"
+                            + "}\n"
+                            + "test('"
+                            + quantifier
+                            + "','"
+                            + input
+                            + "');";
+                };
+
+        Utils.assertWithAllModes_ES6("greedy-*", true, test.apply("*", "123"));
+        Utils.assertWithAllModes_ES6("greedy-+", true, test.apply("+", "123"));
+        Utils.assertWithAllModes_ES6("greedy-?", true, test.apply("?", "123"));
+        Utils.assertWithAllModes_ES6("greedy-{2}", true, test.apply("{2}", "123"));
+        Utils.assertWithAllModes_ES6("greedy-{2,3}", true, test.apply("{2,}", "123"));
+        Utils.assertWithAllModes_ES6("non-greedy-*", true, test.apply("*?", "123"));
+        Utils.assertWithAllModes_ES6("non-greedy-+", true, test.apply("+?", "123"));
+        Utils.assertWithAllModes_ES6("non-greedy-?", true, test.apply("??", "123"));
+        Utils.assertWithAllModes_ES6("non-greedy-{2}", true, test.apply("{2}?", "123"));
+        Utils.assertWithAllModes_ES6("non-greedy-{2,3}", true, test.apply("{2,}?", "123"));
+    }
 }