Fixing http://bugzilla.mozilla.org/show_bug.cgi?id=217379 :

The code in RegExpImpl.findReplen did not take into account that a particular
parenthesis pair can be null if it is not captured. The patch fixes that to
send undefined to the replace function for that case.

js/rhino/src/org/mozilla/javascript/regexp/RegExpImpl.java

@@ -483,7 +483,11 @@ class ReplaceData extends GlobData {
             args[0] = reImpl.lastMatch.toString();
             for (int i=0; i < parenCount; i++) {
                 SubString sub = (SubString) parens.get(i);
-                args[i+1] = sub.toString();
+                if (sub != null) {
+                    args[i+1] = sub.toString();
+                } else {
+                    args[i+1] = Undefined.instance;
+                }
             }
             args[parenCount+1] = new Integer(reImpl.leftContext.length);
             args[parenCount+2] = str;