From 82ee7a2cfb80712f2f17cd50d3005c224a374de8 Mon Sep 17 00:00:00 2001
From: Rick Waldron <waldron.rick@gmail.com>
Date: Mon, 21 Sep 2020 16:00:11 -0400
Subject: [PATCH] Coverage: String.prototype.replace method calls toString on
 replaceValue (regexp object). Fixes gh-2797

---
 ...aceValue-evaluation-order-regexp-object.js | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 test/built-ins/String/prototype/replace/replaceValue-evaluation-order-regexp-object.js

diff --git a/test/built-ins/String/prototype/replace/replaceValue-evaluation-order-regexp-object.js b/test/built-ins/String/prototype/replace/replaceValue-evaluation-order-regexp-object.js
new file mode 100644
index 0000000000..82c2bdf8c0
--- /dev/null
+++ b/test/built-ins/String/prototype/replace/replaceValue-evaluation-order-regexp-object.js
@@ -0,0 +1,27 @@
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-string.prototype.replace
+description: >
+  Non-callable replaceValue is evaluated via toString
+info: |
+  String.prototype.replace ( searchValue, replaceValue )
+
+  If functionalReplace is false, then
+    Set replaceValue to ? ToString(replaceValue).
+---*/
+
+let calls = 0;
+let replaceValue = /$/;
+let oldToString = replaceValue.toString.bind(replaceValue);
+
+replaceValue.toString = () => {
+  calls += 1;
+  return oldToString();
+};
+
+let newString = "".replace("a", replaceValue);
+assert.sameValue(newString, "");
+assert.sameValue(calls, 1);
+assert.sameValue("dollar".replace("dollar", /$/), "/$/");