The area searched by findNext is relatively shortened if the replacement grows the text and while replace() extends findState.endpos_orig, findState.endpos is left alone. As a consequence, the text isn't searched entirely.