1 files changed, 75 insertions, 0 deletions
diff --git a/js/src/tests/non262/RegExp/replace-local-tolength-recompilation.js b/js/src/tests/non262/RegExp/replace-local-tolength-recompilation.js
new file mode 100644
index 0000000000..e03177286f
--- /dev/null
+++ b/js/src/tests/non262/RegExp/replace-local-tolength-recompilation.js
@@ -0,0 +1,75 @@
+// Side-effects when calling ToLength(regExp.lastIndex) in
+// RegExp.prototype[@@replace] for non-global RegExp can recompile the RegExp.
+
+for (var flag of ["", "y"]) {
+    var regExp = new RegExp("a", flag);
+
+    regExp.lastIndex = {
+        valueOf() {
+            regExp.compile("b");
+            return 0;
+        }
+    };
+
+    var result = regExp[Symbol.replace]("b", "pass");
+    assertEq(result, "pass");
+}
+
+// Recompilation modifies flag:
+// Case 1: Adds global flag, validate by checking lastIndex.
+var regExp = new RegExp("a", "");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is now in global mode, RegExpBuiltinExec should update the
+        // lastIndex property to reflect last match.
+        regExp.compile("a", "g");
+        return 0;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 1);
+
+// Case 2: Removes sticky flag with match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("a", "");
+        regExp.lastIndex = 9000;
+        return 0;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 9000);
+
+// Case 3.a: Removes sticky flag without match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("b", "");
+        regExp.lastIndex = 9001;
+        return 0;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 9001);
+
+// Case 3.b: Removes sticky flag without match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("b", "");
+        regExp.lastIndex = 9002;
+        return 10000;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 9002);
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);