diff --git a/src/runtime/RegExpObject.cpp b/src/runtime/RegExpObject.cpp
index 279286d26..1c5e17b05 100644
--- a/src/runtime/RegExpObject.cpp
+++ b/src/runtime/RegExpObject.cpp
@@ -115,16 +115,18 @@ static String* escapePattern(String* patternStr)
         for (i = 0; start + i < len; i++) {
             if (UNLIKELY(accessData.charAt(start + i) == '/') && (i > 0 || len == 1)) {
                 size_t backSlashCount = 0;
-                size_t s = start + i - 1;
-                while (true) {
-                    if (accessData.charAt(s) == '\\') {
-                        backSlashCount++;
-                        if (s == 0) {
+                if (i > 0) {
+                    size_t s = start + i - 1;
+                    while (true) {
+                        if (accessData.charAt(s) == '\\') {
+                            backSlashCount++;
+                            if (s == 0) {
+                                break;
+                            }
+                            s--;
+                        } else {
                             break;
                         }
-                        s--;
-                    } else {
-                        break;
                     }
                 }
                 if (backSlashCount % 2 == 0) {
diff --git a/src/runtime/String.cpp b/src/runtime/String.cpp
index d0757e633..9f1c73ac5 100644
--- a/src/runtime/String.cpp
+++ b/src/runtime/String.cpp
@@ -1205,14 +1205,12 @@ String* String::getSubstitution(ExecutionState& state, String* matched, String*
             } else if (temp == '<' && !namedCapture.isUndefined()) {
                 size_t namedCaptureEnd = i + 1;
                 bool ValidNamedCapturedGroup = false;
-                char16_t temp2 = replacement->charAt(namedCaptureEnd);
                 while (namedCaptureEnd < replacement->length()) {
-                    if (temp2 == '>') {
+                    if (replacement->charAt(namedCaptureEnd) == '>') {
                         ValidNamedCapturedGroup = true;
                         break;
                     }
                     namedCaptureEnd++;
-                    temp2 = replacement->charAt(namedCaptureEnd);
                 }
                 if (ValidNamedCapturedGroup && namedCaptureObj) {
                     String* groupName = replacement->substring((i + 2), (namedCaptureEnd));
diff --git a/src/runtime/String.h b/src/runtime/String.h
index 64e65f123..a9ecda54e 100644
--- a/src/runtime/String.h
+++ b/src/runtime/String.h
@@ -156,6 +156,7 @@ struct StringBufferAccessData {
 
     char16_t charAt(size_t idx) const
     {
+        ASSERT(idx < length);
         if (has8BitContent) {
             return ((LChar*)buffer)[idx];
         } else {