Version

rhino-1.7.12

Test case

var NISLFuzzingFunc=function (){
    var a = 'test'.replace('e', /^/); 
    print(a); 
    var b = 'test'.replace('e', String(/^/))
    print(b);
};
NISLFuzzingFunc();

Execution steps

java -jar rhino/rhino-1.7.12.jar -debug -version 200 testcase.js

Output

tst
t/^/st

Expected behavior

t/^/st
t/^/st

Description

The ES standard stipulates that when the String.prototype.replace (searchValue, replaceValue) method is executed, if the second parameterreplaceValue is not a function, it should be converted into a string first. rhino seems to be missing this step.

Contributor: @Wen Yi