Merge remote-tracking branch 'janek/js_regexp_lastindex_1'

10 files changed, 510 insertions, 22 deletions

diff --git a/js/src/tests/ecma_2017/lastIndex-exec.js b/js/src/tests/ecma_2017/lastIndex-exec.js
new file mode 100644
index 000000000..f42facbe3
--- /dev/null
+++ b/js/src/tests/ecma_2017/lastIndex-exec.js
@@ -0,0 +1,80 @@
+// RegExp.prototype.exec: Test lastIndex changes for ES2017.
+
+// Test various combinations of:
+// - Pattern matches or doesn't match
+// - Global and/or sticky flag is set.
+// - lastIndex exceeds the input string length
+// - lastIndex is +-0
+const testCases = [
+    { regExp: /a/,  lastIndex: 0, input: "a", result: 0 },
+    { regExp: /a/g, lastIndex: 0, input: "a", result: 1 },
+    { regExp: /a/y, lastIndex: 0, input: "a", result: 1 },
+
+    { regExp: /a/,  lastIndex: 0, input: "b", result: 0 },
+    { regExp: /a/g, lastIndex: 0, input: "b", result: 0 },
+    { regExp: /a/y, lastIndex: 0, input: "b", result: 0 },
+
+    { regExp: /a/,  lastIndex: -0, input: "a", result: -0 },
+    { regExp: /a/g, lastIndex: -0, input: "a", result: 1 },
+    { regExp: /a/y, lastIndex: -0, input: "a", result: 1 },
+
+    { regExp: /a/,  lastIndex: -0, input: "b", result: -0 },
+    { regExp: /a/g, lastIndex: -0, input: "b", result: 0 },
+    { regExp: /a/y, lastIndex: -0, input: "b", result: 0 },
+
+    { regExp: /a/,  lastIndex: -1, input: "a", result: -1 },
+    { regExp: /a/g, lastIndex: -1, input: "a", result: 1 },
+    { regExp: /a/y, lastIndex: -1, input: "a", result: 1 },
+
+    { regExp: /a/,  lastIndex: -1, input: "b", result: -1 },
+    { regExp: /a/g, lastIndex: -1, input: "b", result: 0 },
+    { regExp: /a/y, lastIndex: -1, input: "b", result: 0 },
+
+    { regExp: /a/,  lastIndex: 100, input: "a", result: 100 },
+    { regExp: /a/g, lastIndex: 100, input: "a", result: 0 },
+    { regExp: /a/y, lastIndex: 100, input: "a", result: 0 },
+];
+
+// Basic test.
+for (let {regExp, lastIndex, input, result} of testCases) {
+    let re = new RegExp(regExp);
+    re.lastIndex = lastIndex;
+    re.exec(input);
+    assertEq(re.lastIndex, result);
+}
+
+// Test when lastIndex is non-writable.
+for (let {regExp, lastIndex, input} of testCases) {
+    let re = new RegExp(regExp);
+    Object.defineProperty(re, "lastIndex", { value: lastIndex, writable: false });
+    if (re.global || re.sticky) {
+        assertThrowsInstanceOf(() => re.exec(input), TypeError);
+    } else {
+        re.exec(input);
+    }
+    assertEq(re.lastIndex, lastIndex);
+}
+
+// Test when lastIndex is changed to non-writable as a side-effect.
+for (let {regExp, lastIndex, input} of testCases) {
+    let re = new RegExp(regExp);
+    let called = false;
+    re.lastIndex = {
+        valueOf() {
+            assertEq(called, false);
+            called = true;
+            Object.defineProperty(re, "lastIndex", { value: 9000, writable: false });
+            return lastIndex;
+        }
+    };
+    if (re.global || re.sticky) {
+        assertThrowsInstanceOf(() => re.exec(input), TypeError);
+    } else {
+        re.exec(input);
+    }
+    assertEq(re.lastIndex, 9000);
+    assertEq(called, true);
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_2017/lastIndex-match-or-replace.js b/js/src/tests/ecma_2017/lastIndex-match-or-replace.js
new file mode 100644
index 000000000..b0a8b537c
--- /dev/null
+++ b/js/src/tests/ecma_2017/lastIndex-match-or-replace.js
@@ -0,0 +1,122 @@
+// RegExp.prototype[Symbol.match, Symbol.replace]: Test lastIndex changes for ES2017.
+
+// RegExp-like class to test the RegExp method slow paths.
+class DuckRegExp extends RegExp {
+    constructor(pattern, flags) {
+        return Object.create(DuckRegExp.prototype, {
+            regExp: {
+                value: new RegExp(pattern, flags)
+            },
+            lastIndex: {
+                value: 0, writable: true, enumerable: false, configurable: false
+            }
+        });
+    }
+
+    exec(...args) {
+        this.regExp.lastIndex = this.lastIndex;
+        try {
+            return this.regExp.exec(...args);
+        } finally {
+            if (this.global || this.sticky)
+                this.lastIndex = this.regExp.lastIndex;
+        }
+    }
+
+    get source() { return this.regExp.source; }
+
+    get global() { return this.regExp.global; }
+    get ignoreCase() { return this.regExp.ignoreCase; }
+    get multiline() { return this.regExp.multiline; }
+    get sticky() { return this.regExp.sticky; }
+    get unicode() { return this.regExp.unicode; }
+}
+
+// Test various combinations of:
+// - Pattern matches or doesn't match
+// - Global and/or sticky flag is set.
+// - lastIndex exceeds the input string length
+// - lastIndex is +-0
+const testCases = [
+    { regExp: /a/,  lastIndex: 0, input: "a", result: 0 },
+    { regExp: /a/g, lastIndex: 0, input: "a", result: 0 },
+    { regExp: /a/y, lastIndex: 0, input: "a", result: 1 },
+
+    { regExp: /a/,  lastIndex: 0, input: "b", result: 0 },
+    { regExp: /a/g, lastIndex: 0, input: "b", result: 0 },
+    { regExp: /a/y, lastIndex: 0, input: "b", result: 0 },
+
+    { regExp: /a/,  lastIndex: -0, input: "a", result: -0 },
+    { regExp: /a/g, lastIndex: -0, input: "a", result: 0 },
+    { regExp: /a/y, lastIndex: -0, input: "a", result: 1 },
+
+    { regExp: /a/,  lastIndex: -0, input: "b", result: -0 },
+    { regExp: /a/g, lastIndex: -0, input: "b", result: 0 },
+    { regExp: /a/y, lastIndex: -0, input: "b", result: 0 },
+
+    { regExp: /a/,  lastIndex: -1, input: "a", result: -1 },
+    { regExp: /a/g, lastIndex: -1, input: "a", result: 0 },
+    { regExp: /a/y, lastIndex: -1, input: "a", result: 1 },
+
+    { regExp: /a/,  lastIndex: -1, input: "b", result: -1 },
+    { regExp: /a/g, lastIndex: -1, input: "b", result: 0 },
+    { regExp: /a/y, lastIndex: -1, input: "b", result: 0 },
+
+    { regExp: /a/,  lastIndex: 100, input: "a", result: 100 },
+    { regExp: /a/g, lastIndex: 100, input: "a", result: 0 },
+    { regExp: /a/y, lastIndex: 100, input: "a", result: 0 },
+];
+
+for (let method of [RegExp.prototype[Symbol.match], RegExp.prototype[Symbol.replace]]) {
+    for (let Constructor of [RegExp, DuckRegExp]) {
+        // Basic test.
+        for (let {regExp, lastIndex, input, result} of testCases) {
+            let re = new Constructor(regExp);
+            re.lastIndex = lastIndex;
+            Reflect.apply(method, re, [input]);
+            assertEq(re.lastIndex, result);
+        }
+
+        // Test when lastIndex is non-writable.
+        for (let {regExp, lastIndex, input} of testCases) {
+            let re = new Constructor(regExp);
+            Object.defineProperty(re, "lastIndex", { value: lastIndex, writable: false });
+            if (re.global || re.sticky) {
+                assertThrowsInstanceOf(() => Reflect.apply(method, re, [input]), TypeError);
+            } else {
+                Reflect.apply(method, re, [input]);
+            }
+            assertEq(re.lastIndex, lastIndex);
+        }
+
+        // Test when lastIndex is changed to non-writable as a side-effect.
+        for (let {regExp, lastIndex, input, result} of testCases) {
+            let re = new Constructor(regExp);
+            let called = false;
+            re.lastIndex = {
+                valueOf() {
+                    assertEq(called, false);
+                    called = true;
+                    Object.defineProperty(re, "lastIndex", { value: 9000, writable: false });
+                    return lastIndex;
+                }
+            };
+            if (re.sticky) {
+                assertThrowsInstanceOf(() => Reflect.apply(method, re, [input]), TypeError);
+                assertEq(called, true);
+                assertEq(re.lastIndex, 9000);
+            } else if (re.global) {
+                Reflect.apply(method, re, [input]);
+                assertEq(called, false);
+                assertEq(re.lastIndex, result);
+            } else {
+                Reflect.apply(method, re, [input]);
+                assertEq(called, true);
+                assertEq(re.lastIndex, 9000);
+            }
+        }
+    }
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_2017/lastIndex-search.js b/js/src/tests/ecma_2017/lastIndex-search.js
new file mode 100644
index 000000000..5953b3a88
--- /dev/null
+++ b/js/src/tests/ecma_2017/lastIndex-search.js
@@ -0,0 +1,118 @@
+// RegExp.prototype[Symbol.search]: Test lastIndex changes for ES2017.
+
+// RegExp-like class to test the RegExp method slow paths.
+class DuckRegExp extends RegExp {
+    constructor(pattern, flags) {
+        return Object.create(DuckRegExp.prototype, {
+            regExp: {
+                value: new RegExp(pattern, flags)
+            },
+            lastIndex: {
+                value: 0, writable: true, enumerable: false, configurable: false
+            }
+        });
+    }
+
+    exec(...args) {
+        this.regExp.lastIndex = this.lastIndex;
+        try {
+            return this.regExp.exec(...args);
+        } finally {
+            if (this.global || this.sticky)
+                this.lastIndex = this.regExp.lastIndex;
+        }
+    }
+
+    get source() { return this.regExp.source; }
+
+    get global() { return this.regExp.global; }
+    get ignoreCase() { return this.regExp.ignoreCase; }
+    get multiline() { return this.regExp.multiline; }
+    get sticky() { return this.regExp.sticky; }
+    get unicode() { return this.regExp.unicode; }
+}
+
+// Test various combinations of:
+// - Pattern matches or doesn't match
+// - Global and/or sticky flag is set.
+// - lastIndex exceeds the input string length
+// - lastIndex is +-0
+const testCasesNotPositiveZero = [
+    { regExp: /a/,  lastIndex: -1, input: "a" },
+    { regExp: /a/g, lastIndex: -1, input: "a" },
+    { regExp: /a/y, lastIndex: -1, input: "a" },
+
+    { regExp: /a/,  lastIndex: 100, input: "a" },
+    { regExp: /a/g, lastIndex: 100, input: "a" },
+    { regExp: /a/y, lastIndex: 100, input: "a" },
+
+    { regExp: /a/,  lastIndex: -1, input: "b" },
+    { regExp: /a/g, lastIndex: -1, input: "b" },
+    { regExp: /a/y, lastIndex: -1, input: "b" },
+
+    { regExp: /a/,  lastIndex: -0, input: "a" },
+    { regExp: /a/g, lastIndex: -0, input: "a" },
+    { regExp: /a/y, lastIndex: -0, input: "a" },
+
+    { regExp: /a/,  lastIndex: -0, input: "b" },
+    { regExp: /a/g, lastIndex: -0, input: "b" },
+    { regExp: /a/y, lastIndex: -0, input: "b" },
+];
+
+const testCasesPositiveZero = [
+    { regExp: /a/,  lastIndex: 0, input: "a" },
+    { regExp: /a/g, lastIndex: 0, input: "a" },
+    { regExp: /a/y, lastIndex: 0, input: "a" },
+
+    { regExp: /a/,  lastIndex: 0, input: "b" },
+    { regExp: /a/g, lastIndex: 0, input: "b" },
+    { regExp: /a/y, lastIndex: 0, input: "b" },
+];
+
+const testCases = [...testCasesNotPositiveZero, ...testCasesPositiveZero];
+
+for (let Constructor of [RegExp, DuckRegExp]) {
+    // Basic test.
+    for (let {regExp, lastIndex, input} of testCases) {
+        let re = new Constructor(regExp);
+        re.lastIndex = lastIndex;
+        re[Symbol.search](input);
+        assertEq(re.lastIndex, lastIndex);
+    }
+
+    // Test when lastIndex is non-writable and not positive zero.
+    for (let {regExp, lastIndex, input} of testCasesNotPositiveZero) {
+        let re = new Constructor(regExp);
+        Object.defineProperty(re, "lastIndex", { value: lastIndex, writable: false });
+        assertThrowsInstanceOf(() => re[Symbol.search](input), TypeError);
+        assertEq(re.lastIndex, lastIndex);
+    }
+
+    // Test when lastIndex is non-writable and positive zero.
+    for (let {regExp, lastIndex, input} of testCasesPositiveZero) {
+        let re = new Constructor(regExp);
+        Object.defineProperty(re, "lastIndex", { value: lastIndex, writable: false });
+        if (re.global || re.sticky) {
+            assertThrowsInstanceOf(() => re[Symbol.search](input), TypeError);
+        } else {
+            re[Symbol.search](input);
+        }
+        assertEq(re.lastIndex, lastIndex);
+    }
+
+    // Test lastIndex isn't converted to a number.
+    for (let {regExp, lastIndex, input} of testCases) {
+        let re = new RegExp(regExp);
+        let badIndex = {
+            valueOf() {
+                assertEq(false, true);
+            }
+        };
+        re.lastIndex = badIndex;
+        re[Symbol.search](input);
+        assertEq(re.lastIndex, badIndex);
+    }
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_3/String/15.5.4.11.js b/js/src/tests/ecma_3/String/15.5.4.11.js
index 0fd6caaf4..a5515286a 100644
--- a/js/src/tests/ecma_3/String/15.5.4.11.js
+++ b/js/src/tests/ecma_3/String/15.5.4.11.js
@@ -157,7 +157,7 @@ reportCompare(
 
 rex = /y/, rex.lastIndex = 1;
 reportCompare(
-  "xxx0",
+  "xxx1",
   "xxx".replace(rex, "y") + rex.lastIndex,
   "Section 25"
 );
diff --git a/js/src/tests/ecma_5/RegExp/exec.js b/js/src/tests/ecma_5/RegExp/exec.js
index 411f348d9..4284b6e01 100644
--- a/js/src/tests/ecma_5/RegExp/exec.js
+++ b/js/src/tests/ecma_5/RegExp/exec.js
@@ -165,7 +165,7 @@ r = /abc/;
 r.lastIndex = -17;
 res = r.exec("cdefg");
 assertEq(res, null);
-assertEq(r.lastIndex, 0);
+assertEq(r.lastIndex, -17);
 
 r = /abc/g;
 r.lastIndex = -42;
diff --git a/js/src/tests/ecma_6/RegExp/compile-lastIndex.js b/js/src/tests/ecma_6/RegExp/compile-lastIndex.js
index 80c820f43..5bd7e0b98 100644
--- a/js/src/tests/ecma_6/RegExp/compile-lastIndex.js
+++ b/js/src/tests/ecma_6/RegExp/compile-lastIndex.js
@@ -17,15 +17,12 @@ print(BUGNUMBER + ": " + summary);
 
 var regex = /foo/i;
 
-// Aside from making .lastIndex non-writable, this has two incidental effects
+// Aside from making .lastIndex non-writable, this has one incidental effect
 // ubiquitously tested through the remainder of this test:
 //
 //   * RegExp.prototype.compile will do everything it ordinarily does, BUT it
 //     will throw a TypeError when attempting to zero .lastIndex immediately
 //     before succeeding overall.
-//   * RegExp.prototype.test for a non-global and non-sticky regular expression,
-//     in case of a match, will return true (as normal).  BUT if no match is
-//     found, it will throw a TypeError when attempting to modify .lastIndex.
 //
 // Ain't it great?
 Object.defineProperty(regex, "lastIndex", { value: 42, writable: false });
@@ -40,8 +37,8 @@ assertEq(regex.lastIndex, 42);
 
 assertEq(regex.test("foo"), true);
 assertEq(regex.test("FOO"), true);
-assertThrowsInstanceOf(() => regex.test("bar"), TypeError);
-assertThrowsInstanceOf(() => regex.test("BAR"), TypeError);
+assertEq(regex.test("bar"), false);
+assertEq(regex.test("BAR"), false);
 
 assertThrowsInstanceOf(() => regex.compile("bar"), TypeError);
 
@@ -52,10 +49,10 @@ assertEq(regex.unicode, false);
 assertEq(regex.sticky, false);
 assertEq(Object.getOwnPropertyDescriptor(regex, "lastIndex").writable, false);
 assertEq(regex.lastIndex, 42);
-assertThrowsInstanceOf(() => regex.test("foo"), TypeError);
-assertThrowsInstanceOf(() => regex.test("FOO"), TypeError);
+assertEq(regex.test("foo"), false);
+assertEq(regex.test("FOO"), false);
 assertEq(regex.test("bar"), true);
-assertThrowsInstanceOf(() => regex.test("BAR"), TypeError);
+assertEq(regex.test("BAR"), false);
 
 assertThrowsInstanceOf(() => regex.compile("^baz", "m"), TypeError);
 
@@ -66,19 +63,16 @@ assertEq(regex.unicode, false);
 assertEq(regex.sticky, false);
 assertEq(Object.getOwnPropertyDescriptor(regex, "lastIndex").writable, false);
 assertEq(regex.lastIndex, 42);
-assertThrowsInstanceOf(() => regex.test("foo"), TypeError);
-assertThrowsInstanceOf(() => regex.test("FOO"), TypeError);
-assertThrowsInstanceOf(() => regex.test("bar"), TypeError);
-assertThrowsInstanceOf(() => regex.test("BAR"), TypeError);
+assertEq(regex.test("foo"), false);
+assertEq(regex.test("FOO"), false);
+assertEq(regex.test("bar"), false);
+assertEq(regex.test("BAR"), false);
 assertEq(regex.test("baz"), true);
-assertThrowsInstanceOf(() => regex.test("BAZ"), TypeError);
-assertThrowsInstanceOf(() => regex.test("012345678901234567890123456789012345678901baz"),
-                       TypeError);
+assertEq(regex.test("BAZ"), false);
+assertEq(regex.test("012345678901234567890123456789012345678901baz"), false);
 assertEq(regex.test("012345678901234567890123456789012345678901\nbaz"), true);
-assertThrowsInstanceOf(() => regex.test("012345678901234567890123456789012345678901BAZ"),
-                       TypeError);
-assertThrowsInstanceOf(() => regex.test("012345678901234567890123456789012345678901\nBAZ"),
-                       TypeError);
+assertEq(regex.test("012345678901234567890123456789012345678901BAZ"), false);
+assertEq(regex.test("012345678901234567890123456789012345678901\nBAZ"), false);
 
 /******************************************************************************/
 
diff --git a/js/src/tests/ecma_6/RegExp/match-local-tolength-recompilation.js b/js/src/tests/ecma_6/RegExp/match-local-tolength-recompilation.js
new file mode 100644
index 000000000..9a992f81f
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/match-local-tolength-recompilation.js
@@ -0,0 +1,75 @@
+// Side-effects when calling ToLength(regExp.lastIndex) in
+// RegExp.prototype[@@match] for non-global RegExp can recompile the RegExp.
+
+for (var flag of ["", "y"]) {
+    var regExp = new RegExp("a", flag);
+
+    regExp.lastIndex = {
+        valueOf() {
+            regExp.compile("b");
+            return 0;
+        }
+    };
+
+    var result = regExp[Symbol.match]("b");
+    assertEq(result !== null, true);
+}
+
+// Recompilation modifies flag:
+// Case 1: Adds global flag, validate by checking lastIndex.
+var regExp = new RegExp("a", "");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is now in global mode, RegExpBuiltinExec should update the
+        // lastIndex property to reflect last match.
+        regExp.compile("a", "g");
+        return 0;
+    }
+};
+regExp[Symbol.match]("a");
+assertEq(regExp.lastIndex, 1);
+
+// Case 2: Removes sticky flag with match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("a", "");
+        regExp.lastIndex = 9000;
+        return 0;
+    }
+};
+regExp[Symbol.match]("a");
+assertEq(regExp.lastIndex, 9000);
+
+// Case 3.a: Removes sticky flag without match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("b", "");
+        regExp.lastIndex = 9001;
+        return 0;
+    }
+};
+regExp[Symbol.match]("a");
+assertEq(regExp.lastIndex, 9001);
+
+// Case 3.b: Removes sticky flag without match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("b", "");
+        regExp.lastIndex = 9002;
+        return 10000;
+    }
+};
+regExp[Symbol.match]("a");
+assertEq(regExp.lastIndex, 9002);
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_6/RegExp/replace-local-tolength-lastindex.js b/js/src/tests/ecma_6/RegExp/replace-local-tolength-lastindex.js
new file mode 100644
index 000000000..7ba840e00
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/replace-local-tolength-lastindex.js
@@ -0,0 +1,22 @@
+// RegExp.prototype[@@replace] always executes ToLength(regExp.lastIndex) for
+// non-global RegExps.
+
+for (var flag of ["", "g", "y", "gy"]) {
+    var regExp = new RegExp("a", flag);
+
+    var called = false;
+    regExp.lastIndex = {
+        valueOf() {
+            assertEq(called, false);
+            called = true;
+            return 0;
+        }
+    };
+
+    assertEq(called, false);
+    regExp[Symbol.replace]("");
+    assertEq(called, !flag.includes("g"));
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_6/RegExp/replace-local-tolength-recompilation.js b/js/src/tests/ecma_6/RegExp/replace-local-tolength-recompilation.js
new file mode 100644
index 000000000..e03177286
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/replace-local-tolength-recompilation.js
@@ -0,0 +1,75 @@
+// Side-effects when calling ToLength(regExp.lastIndex) in
+// RegExp.prototype[@@replace] for non-global RegExp can recompile the RegExp.
+
+for (var flag of ["", "y"]) {
+    var regExp = new RegExp("a", flag);
+
+    regExp.lastIndex = {
+        valueOf() {
+            regExp.compile("b");
+            return 0;
+        }
+    };
+
+    var result = regExp[Symbol.replace]("b", "pass");
+    assertEq(result, "pass");
+}
+
+// Recompilation modifies flag:
+// Case 1: Adds global flag, validate by checking lastIndex.
+var regExp = new RegExp("a", "");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is now in global mode, RegExpBuiltinExec should update the
+        // lastIndex property to reflect last match.
+        regExp.compile("a", "g");
+        return 0;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 1);
+
+// Case 2: Removes sticky flag with match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("a", "");
+        regExp.lastIndex = 9000;
+        return 0;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 9000);
+
+// Case 3.a: Removes sticky flag without match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("b", "");
+        regExp.lastIndex = 9001;
+        return 0;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 9001);
+
+// Case 3.b: Removes sticky flag without match, validate by checking lastIndex.
+var regExp = new RegExp("a", "y");
+regExp.lastIndex = {
+    valueOf() {
+        // |regExp| is no longer sticky, RegExpBuiltinExec shouldn't modify the
+        // lastIndex property.
+        regExp.compile("b", "");
+        regExp.lastIndex = 9002;
+        return 10000;
+    }
+};
+regExp[Symbol.replace]("a", "");
+assertEq(regExp.lastIndex, 9002);
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/tests/ecma_6/RegExp/search-trace.js b/js/src/tests/ecma_6/RegExp/search-trace.js
index ef14514c6..fc6bee754 100644
--- a/js/src/tests/ecma_6/RegExp/search-trace.js
+++ b/js/src/tests/ecma_6/RegExp/search-trace.js
@@ -56,6 +56,7 @@ assertEq(log,
          "get:lastIndex," +
          "set:lastIndex," +
          "get:exec,call:exec," +
+         "get:lastIndex," +
          "set:lastIndex," +
          "get:result[index],");
 
@@ -70,6 +71,7 @@ assertEq(log,
          "get:lastIndex," +
          "set:lastIndex," +
          "get:exec,call:exec," +
+         "get:lastIndex," +
          "set:lastIndex,");
 
 if (typeof reportCompare === "function")