Skip to content

String.prototype.match/matchAll/search/replace/split access Symbol.* getter on non-Object argument #5373

@Oichkatzelesfrettschen

Description

@Oichkatzelesfrettschen

Per the 2025 spec update, the Symbol lookup must be skipped when the regexp argument is not an Object. All five methods have this bug.

Repro:

Object.defineProperty(BigInt.prototype, Symbol.match, {
  get() { throw new Error("must not be called"); }
});
"a1b".match(1n); // throws -- should return ["1"]

Expected: ["1"]
Got: Error thrown from Symbol.match getter

Same bug in matchAll (Symbol.matchAll), search (Symbol.search), replace (Symbol.replace), split (Symbol.split).

Spec: https://tc39.es/ecma262/#sec-string.prototype.match step 2 — "If regexp is not Object, then ..."

Fix: Guard with if !regexp_arg.is_object() before calling get_method(Symbol.match) in each of the five string prototype methods.

Failing test262: built-ins/String/prototype/match/cstm-matcher-on-*-primitive.js, built-ins/String/prototype/matchAll/cstm-matchall-on-*-primitive.js (27 cases total)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions