Fix bug:

We have found a problem in string.replace() when replacing a regular
expression with a dollar sign. The following code works right when the
replacement string does not contain "$":

$ java -jar js.jar
js> var re = new RegExp("%%%");
js> var price = "%%% 1.99";
js> price.replace(re, "USD");
USD 1.99
js> price.replace(re, "$");
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException
         at
org.mozilla.javascript.regexp.ReplaceData.interpretDollar(RegExpImpl.java:40 0)
         at
org.mozilla.javascript.regexp.ReplaceData.findReplen(RegExpImpl.java:502)
         at
org.mozilla.javascript.regexp.RegExpImpl.replace(RegExpImpl.java:116)
         at
org.mozilla.javascript.NativeString.execMethod(NativeString.java:266)
         at org.mozilla.javascript.IdFunction.call(IdFunction.java:78)
         at org.mozilla.javascript.ScriptRuntime.call(ScriptRuntime.java:1222)
         at org.mozilla.javascript.Interpreter.interpret(Interpreter.java:1940)
         at
org.mozilla.javascript.InterpretedScript.call(InterpretedScript.java:68)
         at
org.mozilla.javascript.InterpretedScript.exec(InterpretedScript.java:59)
         at org.mozilla.javascript.Context.evaluateReader(Context.java:773)
         at
org.mozilla.javascript.tools.shell.Main.evaluateReader(Main.java:312)
         at
org.mozilla.javascript.tools.shell.Main.processSource(Main.java:219)
         at org.mozilla.javascript.tools.shell.Main.exec(Main.java:106)
         at org.mozilla.javascript.tools.shell.Main.main(Main.java:68)

js/rhino/src/org/mozilla/javascript/regexp/RegExpImpl.java

@@ -396,9 +396,11 @@ class ReplaceData extends GlobData {
             if (dp > bp && da[dp-1] == '\\')
                 return null;
 
+        if (dp+1 >= da.length)
+            return null;
         /* Interpret all Perl match-induced dollar variables. */
         dc = da[dp+1];
-        if (NativeRegExp.isDigit(dc)) {            
+        if (NativeRegExp.isDigit(dc)) {
             if ((cx.getLanguageVersion() != Context.VERSION_DEFAULT)
                      && (cx.getLanguageVersion() <= Context.VERSION_1_4)) {
                 if (dc == '0')