This is because if lastIndex is an object with a valueOf() method, it can execute arbitrary code and side effects not permitted by the RegExp fast paths. <rdar://problem/46017305>
Created attachment 355010 [details] proposed patch.
Comment on attachment 355010 [details] proposed patch. r=me
Thanks for the review. Landed in r238267: <http://trac.webkit.org/r238267>.
Comment on attachment 355010 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=355010&action=review > JSTests/ChangeLog:3 > + RegExp operations should not take fast patch if lastIndex is not numeric. oops, this should be "path" not "patch"