[Fix] RegExp#toString: should throw when constructed

paulmillr · Mar 23, 2023 · 6c3fe3d · 6c3fe3d
1 parent f3d5fed
commit 6c3fe3d
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/es6-shim.js b/es6-shim.js
@@ -1787,7 +1787,16 @@
   });
   if (!regexToStringIsGeneric || !regexToStringSupportsGenericFlags) {
     var origRegExpToString = RegExp.prototype.toString;
+    var origShimProto;
     defineProperty(RegExp.prototype, 'toString', function toString() {
+      try {
+        toString.prototype = origShimProto;
+        if (this instanceof toString) {
+          throw new TypeError('RegExp.prototype.toString is not a constructor');
+        }
+      } finally {
+        toString.prototype = void 0;
+      }
       var R = ES.RequireObjectCoercible(this);
       if (Type.regex(R)) {
         return _call(origRegExpToString, R);
@@ -1797,6 +1806,7 @@
       return '/' + pattern + '/' + flags;
     }, true);
     Value.preserveToString(RegExp.prototype.toString, origRegExpToString);
+    origShimProto = RegExp.prototype.toString.prototype;
     RegExp.prototype.toString.prototype = void 0;
   }
 

diff --git a/test/regexp.js b/test/regexp.js
@@ -275,6 +275,8 @@ describe('RegExp', function () {
 
     it('has an undefined prototype', function () {
       expect(RegExp.prototype.toString.prototype).to.equal(undefined);
+
+      expect(function () { return new RegExp.prototype.toString(); }).to['throw'](TypeError);
     });
 
     it('works on regexes', function () {