Fixing http://bugzilla.mozilla.org/show_bug.cgi?id=220367 :

Fix: if in RegExpImpl.getParenSubString parens.get(i) is null, return
emptySubstring

If a branch of | with capturing () does not match , then RegExpImpl.parens will
contain null for corresponding $<group-number> according to code in
NativeRegExp.executeRegExp(). The current code does not check for a possible
null in RegExpImpl.parens when calling toString and the patch fixes that by
making sure that getParenSubString return SubString.emptySubString in such
cases.

js/rhino/src/org/mozilla/javascript/regexp/RegExpImpl.java

@@ -284,9 +284,13 @@ public class RegExpImpl implements RegExpProxy {
      * Assumes zero-based; i.e., for $3, i==2
      */
     SubString getParenSubString(int i) {
-        if (i >= parens.size())
-            return SubString.emptySubString;
-        return (SubString) parens.get(i);
+        if (i < parens.size()) {
+            SubString parsub = (SubString)parens.get(i);
+            if (parsub != null) {
+                return parsub;
+            }
+        }
+        return SubString.emptySubString;
     }
 
     String          input;         /* input string to match (perl $_, GC root) */