third_party/v8/test/mjsunit/regress/regress-782145.js

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

function newFastRegExp() { return new RegExp('.'); }
function toSlowRegExp(re) { re.exec = 42; }

let re = newFastRegExp();
const evil_nonstring = { [Symbol.toPrimitive]: () => toSlowRegExp(re) };
const empty_string = "";

String.prototype.replace.call(evil_nonstring, re, empty_string);

re = newFastRegExp();
String.prototype.match.call(evil_nonstring, re, empty_string);

re = newFastRegExp();
String.prototype.search.call(evil_nonstring, re, empty_string);

re = newFastRegExp();
String.prototype.split.call(evil_nonstring, re, empty_string);