[regexp] Named capture support for string replacements

src/runtime/runtime-regexp.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include <functional>
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
 #include "src/regexp/jsregexp-inl.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-utils.h"
 #include "src/string-builder.h"
 #include "src/string-search.h"
 
 namespace v8 {
 namespace internal {
 
+namespace {
+
+// Looks up the capture of the given name. Returns the (1-based) numbered
+// capture index or -1 on failure.
+int LookupNamedCapture(std::function<bool(String*)> name_matches,
+                       FixedArray* capture_name_map) {
+  // TODO(jgruber): Sort capture_name_map and do binary search via
+  // internalized strings.
+
+  int maybe_capture_index = -1;
+  const int named_capture_count = capture_name_map->length() >> 1;
+  for (int j = 0; j < named_capture_count; j++) {
+    // The format of {capture_name_map} is documented at
+    // JSRegExp::kIrregexpCaptureNameMapIndex.
+    const int name_ix = j * 2;
+    const int index_ix = j * 2 + 1;
+
+    String* capture_name = String::cast(capture_name_map->get(name_ix));
+    if (!name_matches(capture_name)) continue;
+
+    maybe_capture_index = Smi::cast(capture_name_map->get(index_ix))->value();
+    break;
+  }
+
+  return maybe_capture_index;
+}
+
+}  // namespace
+
 class CompiledReplacement {
  public:
   explicit CompiledReplacement(Zone* zone)
       : parts_(1, zone), replacement_substrings_(0, zone), zone_(zone) {}
 
-  // Return whether the replacement is simple.
-  bool Compile(Handle<String> replacement, int capture_count,
-               int subject_length);
+  // Return whether the replacement is simple. Can also fail and return Nothing
+  // if the given replacement string is invalid (and requires throwing a
+  // SyntaxError).
+  Maybe<bool> Compile(Handle<JSRegExp> regexp, Handle<String> replacement,
+                      int capture_count, int subject_length);
 
   // Use Apply only if Compile returned false.
   void Apply(ReplacementStringBuilder* builder, int match_from, int match_to,
              int32_t* match);
 
   // Number of distinct parts of the replacement pattern.
   int parts() { return parts_.length(); }
 
   Zone* zone() const { return zone_; }
 
  private:
   enum PartType {
     SUBJECT_PREFIX = 1,
     SUBJECT_SUFFIX,
     SUBJECT_CAPTURE,
     REPLACEMENT_SUBSTRING,
     REPLACEMENT_STRING,
+    EMPTY,
     NUMBER_OF_PART_TYPES
   };
 
   struct ReplacementPart {
     static inline ReplacementPart SubjectMatch() {
       return ReplacementPart(SUBJECT_CAPTURE, 0);
     }
     static inline ReplacementPart SubjectCapture(int capture_index) {
       return ReplacementPart(SUBJECT_CAPTURE, capture_index);
     }
     static inline ReplacementPart SubjectPrefix() {
       return ReplacementPart(SUBJECT_PREFIX, 0);
     }
     static inline ReplacementPart SubjectSuffix(int subject_length) {
       return ReplacementPart(SUBJECT_SUFFIX, subject_length);
     }
     static inline ReplacementPart ReplacementString() {
       return ReplacementPart(REPLACEMENT_STRING, 0);
     }
     static inline ReplacementPart ReplacementSubString(int from, int to) {
       DCHECK(from >= 0);
       DCHECK(to > from);
       return ReplacementPart(-from, to);
     }
+    static inline ReplacementPart Empty() { return ReplacementPart(EMPTY, 0); }
 
     // If tag <= 0 then it is the negation of a start index of a substring of
     // the replacement pattern, otherwise it's a value from PartType.
     ReplacementPart(int tag, int data) : tag(tag), data(data) {
       // Must be non-positive or a PartType value.
       DCHECK(tag < NUMBER_OF_PART_TYPES);
     }
     // Either a value of PartType or a non-positive number that is
     // the negation of an index into the replacement string.
     int tag;
     // The data value's interpretation depends on the value of tag:
     // tag == SUBJECT_PREFIX ||
-    // tag == SUBJECT_SUFFIX:  data is unused.
+    // tag == SUBJECT_SUFFIX ||
+    // tag == EMPTY:  data is unused.
     // tag == SUBJECT_CAPTURE: data is the number of the capture.
     // tag == REPLACEMENT_SUBSTRING ||
     // tag == REPLACEMENT_STRING:    data is index into array of substrings
     //                               of the replacement string.
     // tag <= 0: Temporary representation of the substring of the replacement
     //           string ranging over -tag .. data.
     //           Is replaced by REPLACEMENT_{SUB,}STRING when we create the
     //           substring objects.
     int data;
   };
 
   template <typename Char>
-  bool ParseReplacementPattern(ZoneList<ReplacementPart>* parts,
-                               Vector<Char> characters, int capture_count,
-                               int subject_length, Zone* zone) {
+  Maybe<bool> ParseReplacementPattern(ZoneList<ReplacementPart>* parts,
+                                      Vector<Char> characters,
+                                      FixedArray* capture_name_map,
+                                      int capture_count, int subject_length,
+                                      Zone* zone) {
+    // Equivalent to String::GetSubstitution, except that this method converts
+    // the replacement string into an internal representation that avoids
+    // repeated parsing when used repeatedly.
+    DCHECK_IMPLIES(capture_name_map != nullptr,
+                   FLAG_harmony_regexp_named_captures);
+
     int length = characters.length();
     int last = 0;
     for (int i = 0; i < length; i++) {
       Char c = characters[i];
       if (c == '$') {
         int next_index = i + 1;
         if (next_index == length) {  // No next character!
           break;
         }
         Char c2 = characters[next_index];
@@ skipping 67 matching lines @@
                 parts->Add(ReplacementPart::ReplacementSubString(last, i),
                            zone);
               }
               DCHECK(capture_ref <= capture_count);
               parts->Add(ReplacementPart::SubjectCapture(capture_ref), zone);
               last = next_index + 1;
             }
             i = next_index;
             break;
           }
+          case '<': {
+            if (capture_name_map == nullptr) {
+              i = next_index;
+              break;
+            }
+
+            // Scan until the next '>', throwing a SyntaxError exception if one
+            // is not found, and let the enclosed substring be groupName.
+
+            const int name_start_index = next_index + 1;
+            int closing_bracket_index = -1;
+            for (int j = name_start_index; j < length; j++) {
+              if (characters[j] == '>') {
+                closing_bracket_index = j;
+                break;
+              }
+            }
+
+            // Throw a SyntaxError for invalid replacement strings.
+            if (closing_bracket_index == -1) return Nothing<bool>();
+
+            Vector<Char> requested_name =
+                characters.SubVector(name_start_index, closing_bracket_index);
+
+            // Let capture be ? Get(namedCaptures, groupName).
+
+            int capture_index = LookupNamedCapture(
+                [=](String* capture_name) {
+                  return capture_name->IsEqualTo(requested_name);
+                },
+                capture_name_map);
+
+            // If capture is undefined, replace the text through the following
+            // '>' with the empty string.
+            // Otherwise, replace the text through the following '>' with
+            // ? ToString(capture).
+
+            DCHECK_IMPLIES(
+                capture_index != -1,
+                1 <= capture_index && capture_index <= capture_count);
+
+            ReplacementPart replacement =
+                (capture_index == -1)
+                    ? ReplacementPart::Empty()
+                    : ReplacementPart::SubjectCapture(capture_index);
+
+            if (i > last) {
+              parts->Add(ReplacementPart::ReplacementSubString(last, i), zone);
+            }
+            parts->Add(replacement, zone);
+            last = closing_bracket_index + 1;
+            i = closing_bracket_index;
+            break;
+          }
           default:
             i = next_index;
             break;
         }
       }
     }
     if (length > last) {
       if (last == 0) {
         // Replacement is simple.  Do not use Apply to do the replacement.
-        return true;
+        return Just(true);
       } else {
         parts->Add(ReplacementPart::ReplacementSubString(last, length), zone);
       }
     }
-    return false;
+    return Just(false);
   }
 
   ZoneList<ReplacementPart> parts_;
   ZoneList<Handle<String> > replacement_substrings_;
   Zone* zone_;
 };
 
-
-bool CompiledReplacement::Compile(Handle<String> replacement, int capture_count,
-                                  int subject_length) {
+Maybe<bool> CompiledReplacement::Compile(Handle<JSRegExp> regexp,
+                                         Handle<String> replacement,
+                                         int capture_count,
+                                         int subject_length) {
   {
     DisallowHeapAllocation no_gc;
     String::FlatContent content = replacement->GetFlatContent();
     DCHECK(content.IsFlat());
-    bool simple = false;
+
+    FixedArray* capture_name_map = nullptr;
+    if (capture_count > 0) {
+      DCHECK_EQ(regexp->TypeTag(), JSRegExp::IRREGEXP);
+      Object* maybe_capture_name_map = regexp->CaptureNameMap();
+      if (maybe_capture_name_map->IsFixedArray()) {
+        DCHECK(FLAG_harmony_regexp_named_captures);
+        capture_name_map = FixedArray::cast(maybe_capture_name_map);
+      }
+    }
+
+    Maybe<bool> simple = Nothing<bool>();
     if (content.IsOneByte()) {
       simple = ParseReplacementPattern(&parts_, content.ToOneByteVector(),
-                                       capture_count, subject_length, zone());
+                                       capture_name_map, capture_count,
+                                       subject_length, zone());
     } else {
       DCHECK(content.IsTwoByte());
       simple = ParseReplacementPattern(&parts_, content.ToUC16Vector(),
-                                       capture_count, subject_length, zone());
+                                       capture_name_map, capture_count,
+                                       subject_length, zone());
     }
-    if (simple) return true;
+    if (simple.IsNothing() || simple.FromJust()) return simple;
   }
 
   Isolate* isolate = replacement->GetIsolate();
   // Find substrings of replacement string and create them as String objects.
   int substring_index = 0;
   for (int i = 0, n = parts_.length(); i < n; i++) {
     int tag = parts_[i].tag;
     if (tag <= 0) {  // A replacement string slice.
       int from = -tag;
       int to = parts_[i].data;
       replacement_substrings_.Add(
           isolate->factory()->NewSubString(replacement, from, to), zone());
       parts_[i].tag = REPLACEMENT_SUBSTRING;
       parts_[i].data = substring_index;
       substring_index++;
     } else if (tag == REPLACEMENT_STRING) {
       replacement_substrings_.Add(replacement, zone());
       parts_[i].data = substring_index;
       substring_index++;
     }
   }
-  return false;
+  return Just(false);
 }
 
 
 void CompiledReplacement::Apply(ReplacementStringBuilder* builder,
                                 int match_from, int match_to, int32_t* match) {
   DCHECK_LT(0, parts_.length());
   for (int i = 0, n = parts_.length(); i < n; i++) {
     ReplacementPart part = parts_[i];
     switch (part.tag) {
       case SUBJECT_PREFIX:
@@ skipping 12 matching lines @@
         int to = match[capture * 2 + 1];
         if (from >= 0 && to > from) {
           builder->AddSubjectSlice(from, to);
         }
         break;
       }
       case REPLACEMENT_SUBSTRING:
       case REPLACEMENT_STRING:
         builder->AddString(replacement_substrings_[part.data]);
         break;
+      case EMPTY:
+        break;
       default:
         UNREACHABLE();
     }
   }
 }
 
 void FindOneByteStringIndices(Vector<const uint8_t> subject, uint8_t pattern,
                               List<int>* indices, unsigned int limit) {
   DCHECK(limit > 0);
   // Collect indices of pattern in subject using memchr.
@@ skipping 195 matching lines @@
 
 MUST_USE_RESULT static Object* StringReplaceGlobalRegExpWithString(
     Isolate* isolate, Handle<String> subject, Handle<JSRegExp> regexp,
     Handle<String> replacement, Handle<RegExpMatchInfo> last_match_info) {
   DCHECK(subject->IsFlat());
   DCHECK(replacement->IsFlat());
 
   int capture_count = regexp->CaptureCount();
   int subject_length = subject->length();
 
+  JSRegExp::Type typeTag = regexp->TypeTag();
+  if (typeTag == JSRegExp::IRREGEXP) {
+    // Ensure the RegExp is compiled so we can access the capture-name map.
+    RegExpImpl::IrregexpPrepare(regexp, subject);
+  }
+
   // CompiledReplacement uses zone allocation.
   Zone zone(isolate->allocator(), ZONE_NAME);
   CompiledReplacement compiled_replacement(&zone);
-  bool simple_replace =
-      compiled_replacement.Compile(replacement, capture_count, subject_length);
+  Maybe<bool> maybe_simple_replace = compiled_replacement.Compile(
+      regexp, replacement, capture_count, subject_length);
+  if (maybe_simple_replace.IsNothing()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewSyntaxError(MessageTemplate::kRegExpInvalidReplaceString,
+                                replacement));
+  }
+
+  const bool simple_replace = maybe_simple_replace.FromJust();
 
   // Shortcut for simple non-regexp global replacements
-  if (regexp->TypeTag() == JSRegExp::ATOM && simple_replace) {
+  if (typeTag == JSRegExp::ATOM && simple_replace) {
     if (subject->HasOnlyOneByteChars() && replacement->HasOnlyOneByteChars()) {
       return StringReplaceGlobalAtomRegExpWithString<SeqOneByteString>(
           isolate, subject, regexp, replacement, last_match_info);
     } else {
       return StringReplaceGlobalAtomRegExpWithString<SeqTwoByteString>(
           isolate, subject, regexp, replacement, last_match_info);
     }
   }
 
   RegExpImpl::GlobalCache global_cache(regexp, subject, isolate);
@@ skipping 130 matching lines @@
   int allocated_string_size = ResultSeqString::SizeFor(new_length);
   int delta = allocated_string_size - string_size;
 
   answer->set_length(position);
   if (delta == 0) return *answer;
 
   Address end_of_string = answer->address() + string_size;
   Heap* heap = isolate->heap();
 
   // The trimming is performed on a newly allocated object, which is on a
-  // fresly allocated page or on an already swept page. Hence, the sweeper
+  // freshly allocated page or on an already swept page. Hence, the sweeper
   // thread can not get confused with the filler creation. No synchronization
   // needed.
   // TODO(hpayer): We should shrink the large object page if the size
   // of the object changed significantly.
   if (!heap->lo_space()->Contains(*answer)) {
     heap->CreateFillerObjectAt(end_of_string, delta, ClearRecordedSlots::kNo);
   }
   heap->AdjustLiveBytes(*answer, -delta);
   return *answer;
 }
@@ skipping 173 matching lines @@
       isolate->regexp_internal_match_info();
 
   return StringReplaceGlobalRegExpWithStringHelper(
       isolate, regexp, subject, replacement, internal_match_info);
 }
 
 namespace {
 
 class MatchInfoBackedMatch : public String::Match {
  public:
-  MatchInfoBackedMatch(Isolate* isolate, Handle<String> subject,
+  MatchInfoBackedMatch(Isolate* isolate, Handle<JSRegExp> regexp,
+                       Handle<String> subject,
                        Handle<RegExpMatchInfo> match_info)
       : isolate_(isolate), match_info_(match_info) {
     subject_ = String::Flatten(subject);
+
+    if (regexp->TypeTag() == JSRegExp::IRREGEXP) {
+      Object* o = regexp->CaptureNameMap();
+      has_named_captures_ = o->IsFixedArray();
+      if (has_named_captures_) {
+        DCHECK(FLAG_harmony_regexp_named_captures);
+        capture_name_map_ = handle(FixedArray::cast(o));
+      }
+    } else {
+      has_named_captures_ = false;
+    }
   }
 
   Handle<String> GetMatch() override {
     return RegExpUtils::GenericCaptureGetter(isolate_, match_info_, 0, nullptr);
   }
 
-  MaybeHandle<String> GetCapture(int i, bool* capture_exists) override {
-    Handle<Object> capture_obj = RegExpUtils::GenericCaptureGetter(
-        isolate_, match_info_, i, capture_exists);
-    return (*capture_exists) ? Object::ToString(isolate_, capture_obj)
-                             : isolate_->factory()->empty_string();
-  }
-
   Handle<String> GetPrefix() override {
     const int match_start = match_info_->Capture(0);
     return isolate_->factory()->NewSubString(subject_, 0, match_start);
   }
 
   Handle<String> GetSuffix() override {
     const int match_end = match_info_->Capture(1);
     return isolate_->factory()->NewSubString(subject_, match_end,
                                              subject_->length());
   }
 
+  bool HasNamedCaptures() override { return has_named_captures_; }
+
   int CaptureCount() override {
     return match_info_->NumberOfCaptureRegisters() / 2;
   }
 
-  virtual ~MatchInfoBackedMatch() {}
+  MaybeHandle<String> GetCapture(int i, bool* capture_exists) override {
+    Handle<Object> capture_obj = RegExpUtils::GenericCaptureGetter(
+        isolate_, match_info_, i, capture_exists);
+    return (*capture_exists) ? Object::ToString(isolate_, capture_obj)
+                             : isolate_->factory()->empty_string();
+  }
+
+  MaybeHandle<String> GetNamedCapture(Handle<String> name,
+                                      bool* capture_exists) override {
+    DCHECK(has_named_captures_);
+    const int capture_index = LookupNamedCapture(
+        [=](String* capture_name) { return capture_name->Equals(*name); },
+        *capture_name_map_);
+
+    if (capture_index == -1) {
+      *capture_exists = false;
+      return name;  // Arbitrary string handle.
+    }
+
+    DCHECK(1 <= capture_index && capture_index <= CaptureCount());
+    return GetCapture(capture_index, capture_exists);
+  }
 
  private:
   Isolate* isolate_;
   Handle<String> subject_;
   Handle<RegExpMatchInfo> match_info_;
+
+  bool has_named_captures_;
+  Handle<FixedArray> capture_name_map_;
 };
 
 class VectorBackedMatch : public String::Match {
  public:
   VectorBackedMatch(Isolate* isolate, Handle<String> subject,
                     Handle<String> match, int match_position,
-                    std::vector<Handle<Object>>* captures)
+                    std::vector<Handle<Object>>* captures,
+                    Handle<Object> groups_obj)
       : isolate_(isolate),
         match_(match),
         match_position_(match_position),
         captures_(captures) {
     subject_ = String::Flatten(subject);
+
+    DCHECK(groups_obj->IsUndefined(isolate) || groups_obj->IsJSReceiver());
+    has_named_captures_ = !groups_obj->IsUndefined(isolate);
+    if (has_named_captures_) groups_obj_ = Handle<JSReceiver>::cast(groups_obj);
   }
 
   Handle<String> GetMatch() override { return match_; }
 
-  MaybeHandle<String> GetCapture(int i, bool* capture_exists) override {
-    Handle<Object> capture_obj = captures_->at(i);
-    if (capture_obj->IsUndefined(isolate_)) {
-      *capture_exists = false;
-      return isolate_->factory()->empty_string();
-    }
-    *capture_exists = true;
-    return Object::ToString(isolate_, capture_obj);
-  }
-
   Handle<String> GetPrefix() override {
     return isolate_->factory()->NewSubString(subject_, 0, match_position_);
   }
 
   Handle<String> GetSuffix() override {
     const int match_end_position = match_position_ + match_->length();
     return isolate_->factory()->NewSubString(subject_, match_end_position,
                                              subject_->length());
   }
 
+  bool HasNamedCaptures() override { return has_named_captures_; }
+
   int CaptureCount() override { return static_cast<int>(captures_->size()); }
 
-  virtual ~VectorBackedMatch() {}
+  MaybeHandle<String> GetCapture(int i, bool* capture_exists) override {
+    Handle<Object> capture_obj = captures_->at(i);
+    if (capture_obj->IsUndefined(isolate_)) {
+      *capture_exists = false;
+      return isolate_->factory()->empty_string();
+    }
+    *capture_exists = true;
+    return Object::ToString(isolate_, capture_obj);
+  }
+
+  MaybeHandle<String> GetNamedCapture(Handle<String> name,
+                                      bool* capture_exists) override {
+    DCHECK(has_named_captures_);
+    Handle<Object> capture_obj;
+    ASSIGN_RETURN_ON_EXCEPTION(isolate_, capture_obj,
+                               Object::GetProperty(groups_obj_, name), String);
+    if (capture_obj->IsUndefined(isolate_)) {
+      *capture_exists = false;
+      return name;
+    } else {
+      *capture_exists = true;
+      return Object::ToString(isolate_, capture_obj);
+    }
+  }
 
  private:
   Isolate* isolate_;
   Handle<String> subject_;
   Handle<String> match_;
   const int match_position_;
   std::vector<Handle<Object>>* captures_;
+
+  bool has_named_captures_;
+  Handle<JSReceiver> groups_obj_;
 };
 
 // Create the groups object (see also the RegExp result creation in
 // RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo).
 Handle<JSObject> ConstructNamedCaptureGroupsObject(
     Isolate* isolate, Handle<FixedArray> capture_map,
     std::function<Object*(int)> f_get_capture) {
   Handle<JSObject> groups = isolate->factory()->NewJSObjectWithNullProto();
 
   const int capture_count = capture_map->length() >> 1;
@@ skipping 125 matching lines @@
           } else {
             DCHECK(current_match[i * 2 + 1] < 0);
             elements->set(cursor++, isolate->heap()->undefined_value());
           }
         }
 
         elements->set(cursor++, Smi::FromInt(match_start));
         elements->set(cursor++, *subject);
 
         if (has_named_captures) {
+          DCHECK(FLAG_harmony_regexp_named_captures);
           Handle<FixedArray> capture_map =
               Handle<FixedArray>::cast(maybe_capture_map);
           Handle<JSObject> groups = ConstructNamedCaptureGroupsObject(
               isolate, capture_map, [=](int ix) { return elements->get(ix); });
           elements->set(cursor++, *groups);
         }
 
         DCHECK_EQ(cursor, argc);
         builder.Add(*isolate->factory()->NewJSArrayWithElements(elements));
       } else {
@@ skipping 91 matching lines @@
 
     const int start_index = match_indices->Capture(0);
     const int end_index = match_indices->Capture(1);
 
     if (sticky) regexp->SetLastIndex(end_index);
 
     IncrementalStringBuilder builder(isolate);
     builder.AppendString(factory->NewSubString(string, 0, start_index));
 
     if (replace->length() > 0) {
-      MatchInfoBackedMatch m(isolate, string, match_indices);
+      MatchInfoBackedMatch m(isolate, regexp, string, match_indices);
       Handle<String> replacement;
       ASSIGN_RETURN_ON_EXCEPTION(isolate, replacement,
                                  String::GetSubstitution(isolate, &m, replace),
                                  String);
       builder.AppendString(replacement);
     }
 
     builder.AppendString(
         factory->NewSubString(string, end_index, string->length()));
     return builder.Finish();
@@ skipping 112 matching lines @@
   const int m = match_indices->NumberOfCaptureRegisters() / 2;
 
   bool has_named_captures = false;
   Handle<FixedArray> capture_map;
   if (m > 1) {
     // The existence of capture groups implies IRREGEXP kind.
     DCHECK_EQ(regexp->TypeTag(), JSRegExp::IRREGEXP);
 
     Object* maybe_capture_map = regexp->CaptureNameMap();
     if (maybe_capture_map->IsFixedArray()) {
+      DCHECK(FLAG_harmony_regexp_named_captures);
       has_named_captures = true;
       capture_map = handle(FixedArray::cast(maybe_capture_map));
     }
   }
 
   const int argc = has_named_captures ? m + 3 : m + 2;
   ScopedVector<Handle<Object>> argv(argc);
 
   int cursor = 0;
   for (int j = 0; j < m; j++) {
@@ skipping 367 matching lines @@
       Handle<Object> replacement_obj;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, replacement_obj,
           Execution::Call(isolate, replace_obj, factory->undefined_value(),
                           argc, argv.start()));
 
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, replacement, Object::ToString(isolate, replacement_obj));
     } else {
       DCHECK(!functional_replace);
-      VectorBackedMatch m(isolate, string, match, position, &captures);
+      if (!groups_obj->IsUndefined(isolate)) {
+        // TODO(jgruber): Behavior in this case is not yet specced.
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+            isolate, groups_obj, JSReceiver::ToObject(isolate, groups_obj));
+      }
+      VectorBackedMatch m(isolate, string, match, position, &captures,
+                          groups_obj);
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, replacement, String::GetSubstitution(isolate, &m, replace));
     }
 
     if (position >= next_source_position) {
       builder.AppendString(
           factory->NewSubString(string, next_source_position, position));
       builder.AppendString(replacement);
 
       next_source_position = position + match_length;
@@ skipping 31 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_IsRegExp) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(Object, obj, 0);
   return isolate->heap()->ToBoolean(obj->IsJSRegExp());
 }
 
 }  // namespace internal
 }  // namespace v8