poe-code 14.0.72 → 14.0.74

package/packages/safe-js/dist/interp/methods/string.js

@@ -1,12 +1,16 @@
+import { types } from "node:util";
 import { invokeBuiltinClosure } from "../builtin-call.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { normalizeLastIndex } from "../regex/engine.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
 import { retainValues } from "../resources.js";
-import { getSandboxDataProperty } from "../object-model.js";
-import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex } from "../values.js";
-import { executeRegex, toMatchArray } from "./regex.js";
-const SPLIT_STRING_MESSAGE = "String#split only supports string separator values.";
+import { getSandboxDataProperty, getSandboxPropertyDescriptor, hasRegexPropertyOverride } from "../object-model.js";
+import { readPropertyDescriptor } from "../accessors.js";
+import { createSandboxBox } from "../boxed.js";
+import { setSandboxProperty } from "../interpreter.js";
+import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex, measureSandboxData } from "../values.js";
+import { executeRegex, getRegexMember, regexExec, regexFlagProperties, regexSearch, toMatchArray } from "./regex.js";
+import { restoreSandboxRegExpIterator } from "../regexp-iterator.js";
 export const stringMethodNames = new Set([
     "at",
     "charAt",
@@ -86,27 +90,68 @@ export function validateStringMethodArguments(_methodName, _args) { }
 export function callStringMethod(value, methodName, args, budget, callClosure = async (closure, closureArgs) => await closure.call(closureArgs), parent, context) {
     if (value === null || value === undefined)
         throw new TypeError(`String#${methodName} requires a non-null receiver.`);
-    const fallback = () => typeof value === "string"
-        ? callStringMethodBody(value, methodName, args, budget, callClosure, parent, context)
-        : Promise.resolve(sandboxString(value, budget, context)).then(string => callStringMethodBody(string, methodName, args, budget, callClosure, parent, context));
+    const fallback = (coercePattern = false) => {
+        const apply = (string) => {
+            if (coercePattern && (methodName === "match" || methodName === "matchAll" || methodName === "search"))
+                return callStringPattern(string, methodName, args[0], budget, parent, context);
+            const useRegex = isSandboxRegex(args[0]) && !coercePattern;
+            if (methodName === "replace" || methodName === "replaceAll")
+                return callReplaceLikeMethod(string, methodName, args, budget, callClosure, useRegex, context);
+            if (methodName === "split")
+                return callSplit(string, args, budget, useRegex, parent, context);
+            return callStringMethodBody(string, methodName, args, budget, parent, context);
+        };
+        return typeof value === "string" ? apply(value) : Promise.resolve(sandboxString(value, budget, context)).then(apply);
+    };
     const symbol = methodName === "match" ? Symbol.match
         : methodName === "search" ? Symbol.search
-            : methodName === "split" ? Symbol.split : undefined;
+            : methodName === "matchAll" ? Symbol.matchAll
+                : methodName === "replace" || methodName === "replaceAll" ? Symbol.replace
+                    : methodName === "split" ? Symbol.split : undefined;
     const pattern = args[0];
+    if (symbol !== undefined && types.isRegExp(pattern))
+        throw new TypeError(`String#${methodName} does not accept unbranded host RegExp values.`);
     if (symbol === undefined || pattern === null || pattern === undefined)
         return fallback();
-    const applyHook = (hook) => {
-        if (hook === null || hook === undefined)
-            return fallback();
-        if (!isSandboxClosure(hook))
-            throw new TypeError(`String#${methodName} symbol hook must be callable.`);
-        return invokeBuiltinClosure(hook, methodName === "split" ? [value, args[1]] : [value], budget, context, pattern);
+    const readProperty = (key) => context?.getProperty !== undefined
+        ? context.getProperty(pattern, key)
+        : key === "flags" && isSandboxRegex(pattern) && getSandboxPropertyDescriptor(pattern, key, budget) === undefined
+            ? getRegexMember(pattern, key, budget, context) : getSandboxDataProperty(pattern, key, budget);
+    const dispatch = () => {
+        const overriddenRegex = isSandboxRegex(pattern) && getSandboxPropertyDescriptor(pattern, symbol, budget) !== undefined;
+        const applyHook = (hook) => {
+            if (hook === null || hook === undefined)
+                return fallback(overriddenRegex);
+            if (!isSandboxClosure(hook))
+                throw new TypeError(`String#${methodName} symbol hook must be callable.`);
+            return invokeBuiltinClosure(hook, symbol === Symbol.split || symbol === Symbol.replace ? [value, args[1]] : [value], budget, context, pattern);
+        };
+        const hook = readProperty(symbol);
+        return hook instanceof Promise ? hook.then(applyHook) : applyHook(hook);
     };
-    return context?.getProperty !== undefined
-        ? Promise.resolve(context.getProperty(pattern, symbol)).then(applyHook)
-        : applyHook(getSandboxDataProperty(pattern, symbol, budget));
+    if ((methodName === "replaceAll" || methodName === "matchAll") &&
+        (typeof pattern === "object" || typeof pattern === "function")) {
+        const checkFlags = (flags) => {
+            const checkText = (text) => {
+                if (!text.includes("g"))
+                    throw new TypeError(`String#${methodName} requires a global regex.`);
+                return dispatch();
+            };
+            const text = sandboxString(flags, budget, context);
+            return typeof text === "string" ? checkText(text) : text.then(checkText);
+        };
+        const checkMatch = (match) => {
+            if (!(match === undefined ? isSandboxRegex(pattern) : Boolean(match)))
+                return dispatch();
+            const flags = readProperty("flags");
+            return flags instanceof Promise ? flags.then(checkFlags) : checkFlags(flags);
+        };
+        const match = readProperty(Symbol.match);
+        return match instanceof Promise ? match.then(checkMatch) : checkMatch(match);
+    }
+    return dispatch();
 }
-function callStringMethodBody(value, methodName, args, budget, callClosure = async (closure, closureArgs) => await closure.call(closureArgs), parent, context) {
+function callStringMethodBody(value, methodName, args, budget, parent, context) {
     if (methodName === "concat" && args.some(argument => argument !== null && typeof argument === "object")) {
         return callConcat(value, args, budget, context);
     }
@@ -147,13 +192,16 @@ function callStringMethodBody(value, methodName, args, budget, callClosure = asy
         }
         return budget.allocateString(result + value.slice(spanStart));
     }
-    if (methodName === "replace" || methodName === "replaceAll") {
-        return callReplaceLikeMethod(value, methodName, args, budget, callClosure, context);
-    }
     const regex = args[0];
-    if (isSandboxRegex(regex) && regex.lastIndex !== null && typeof regex.lastIndex === "object" &&
-        ((methodName === "match" && !regex.flags.includes("g")) ||
-            (methodName === "matchAll" && regex.flags.includes("g")))) {
+    if (methodName === "search" && isSandboxRegex(regex) &&
+        hasRegexPropertyOverride(regex, ["exec"], budget))
+        return regexSearch(regex, value, budget, context);
+    if (methodName === "match" && isSandboxRegex(regex) &&
+        hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
+        return regexMatch(value, regex, budget, context);
+    if (isSandboxRegex(regex) && (methodName === "matchAll" ||
+        (methodName === "match" && !regex.flags.includes("g") &&
+            regex.lastIndex !== null && typeof regex.lastIndex === "object"))) {
         return callStringRegexCursor(value, methodName, regex, budget, parent, context);
     }
     if ((methodName === "match" || methodName === "matchAll" || methodName === "search") && !isSandboxRegex(args[0])) {
@@ -162,9 +210,6 @@ function callStringMethodBody(value, methodName, args, budget, callClosure = asy
     const operation = budget.acquireCompileOwner(false, parent?.owner);
     const compilation = new CompileScope(operation.owner);
     try {
-        if (methodName === "split") {
-            return callSplit(value, args, budget, compilation);
-        }
         if (methodName === "match" || methodName === "matchAll" || methodName === "search") {
             return callMatchLikeMethod(value, methodName, args, compilation);
         }
@@ -280,43 +325,55 @@ async function callConcat(value, args, budget, context) {
         release();
     }
 }
-function callReplaceLikeMethod(value, methodName, args, budget, callClosure, context) {
+function callReplaceLikeMethod(value, methodName, args, budget, callClosure, useRegex, context) {
     const search = args[0];
     const replacement = args[1];
-    if ((!isSandboxRegex(search) && typeof search !== "string") ||
+    const regexSearch = useRegex && isSandboxRegex(search);
+    if ((!regexSearch && typeof search !== "string") ||
         (typeof replacement !== "string" && !isSandboxClosure(replacement))) {
-        throw new TypeError(`String#${methodName} only supports string or regex search values and string or function replacements.`);
+        return (async () => {
+            let normalizedSearch;
+            let normalizedReplacement;
+            const release = retainValues(budget, () => [normalizedSearch, normalizedReplacement]);
+            try {
+                normalizedSearch = regexSearch ? search : await sandboxString(search, budget, context);
+                normalizedReplacement = isSandboxClosure(replacement) ? replacement : await sandboxString(replacement, budget, context);
+                return await callReplaceLikeMethod(value, methodName, [normalizedSearch, normalizedReplacement], budget, callClosure, useRegex, context);
+            }
+            finally {
+                release();
+            }
+        })();
     }
     if (isSandboxRegex(search)) {
-        if (methodName === "replaceAll" && !search.flags.includes("g")) {
-            throw new TypeError("String#replaceAll requires a global regex.");
-        }
-        return replaceRegex(value, search, replacement, methodName === "replaceAll", budget, callClosure, context);
+        return replaceRegex(value, search, replacement, budget, callClosure, context);
     }
     if (typeof replacement === "string") {
         return budget.allocateString(methodName === "replace"
             ? value.replace(search, replacement)
             : value.replaceAll(search, replacement));
     }
-    return replaceWithClosure(value, search, replacement, methodName === "replaceAll", budget, callClosure);
+    return replaceWithClosure(value, search, replacement, methodName === "replaceAll", budget, callClosure, context);
 }
-async function replaceRegex(value, regex, replacement, replaceAll, budget, callClosure, context) {
+async function replaceRegex(value, regex, replacement, budget, callClosure, context) {
+    if (hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
+        return regexReplace(value, regex, replacement, budget, callClosure, context);
     if (regex.flags.includes("g"))
         regex.lastIndex = 0;
     const cursor = regex.lastIndex;
+    let result = "";
     const retained = {};
-    budget.setRetainedValues(retained, () => [value, regex, cursor, replacement]);
+    budget.setRetainedValues(retained, () => [value, regex, cursor, replacement, result]);
     try {
         const lastIndex = await sandboxNumber(cursor, budget, context);
-        const matches = collectRegexMatches(regex, value, replaceAll || regex.flags.includes("g"), undefined, lastIndex);
-        let result = "";
+        const matches = collectRegexMatches(regex, value, regex.flags.includes("g"), undefined, lastIndex);
         let copiedThrough = 0;
         for (const match of matches) {
             result += value.slice(copiedThrough, match.index);
             result +=
                 typeof replacement === "string"
-                    ? expandReplacement(replacement, match.text, match.captures, value, match.index)
-                    : String(await callClosure(replacement, [match.text, ...match.captures, match.index, value]));
+                    ? await expandReplacement(replacement, match.text, match.captures, value, match.index, budget, context)
+                    : await sandboxString(await callClosure(replacement, [match.text, ...match.captures, match.index, value]), budget, context);
             copiedThrough = match.index + match.text.length;
         }
         result += value.slice(copiedThrough);
@@ -326,62 +383,201 @@ async function replaceRegex(value, regex, replacement, replaceAll, budget, callC
         budget.setRetainedValues(retained, undefined);
     }
 }
-function expandReplacement(replacement, match, captures, input, matchIndex) {
+function readReplacementProperty(target, key, budget, context) {
+    if (context?.getProperty !== undefined)
+        return context.getProperty(target, key);
+    const descriptor = getSandboxPropertyDescriptor(target, key, budget);
+    if (descriptor !== undefined)
+        return readPropertyDescriptor(descriptor, target, context);
+    return isSandboxRegex(target) ? getRegexMember(target, key, budget, context) : undefined;
+}
+export async function regexReplace(input, regex, replacementInput, budget, callClosure, context) {
+    if (regex === null || typeof regex !== "object")
+        throw new TypeError("RegExp replace requires an object receiver.");
+    let value;
+    let replacement;
+    const matches = [];
+    let current;
+    let field;
+    let groups;
+    let matched;
+    let captures = [];
     let result = "";
-    for (let index = 0; index < replacement.length; index += 1) {
-        const character = replacement.charAt(index);
-        if (character !== "$") {
-            result += character;
-            continue;
-        }
-        const token = replacement.charAt(index + 1);
-        if (token === "$") {
-            result += "$";
-        }
-        else if (token === "&") {
-            result += match;
+    let flags;
+    const release = retainValues(budget, () => [input, value, regex, replacementInput, replacement, matches, current, field, groups, matched, captures, result, flags]);
+    try {
+        value = await sandboxString(input, budget, context);
+        input = undefined;
+        replacement = isSandboxClosure(replacementInput) ? replacementInput : await sandboxString(replacementInput, budget, context);
+        replacementInput = undefined;
+        if (isSandboxRegex(regex) && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
+            release();
+            return await replaceRegex(value, regex, replacement, budget, callClosure, context);
         }
-        else if (token === "`") {
-            result += input.slice(0, matchIndex);
+        field = await readReplacementProperty(regex, "flags", budget, context);
+        flags = await sandboxString(field, budget, context);
+        field = undefined;
+        const global = flags.includes("g");
+        const fullUnicode = flags.includes("u") || flags.includes("v");
+        flags = undefined;
+        if (global)
+            await setSandboxProperty(regex, "lastIndex", 0, budget, true, context);
+        while (true) {
+            budget.visitNode();
+            current = await regexExec(regex, value, budget, context);
+            if (current === null)
+                break;
+            budget.allocateArrayLength(matches.length + 1);
+            matches.push(current);
+            if (!global)
+                break;
+            field = await readReplacementProperty(current, "0", budget, context);
+            matched = await sandboxString(field, budget, context);
+            field = undefined;
+            if (matched.length === 0) {
+                field = await readReplacementProperty(regex, "lastIndex", budget, context);
+                const index = normalizeLastIndex(await sandboxNumber(field, budget, context));
+                const point = fullUnicode ? value.codePointAt(index) : undefined;
+                await setSandboxProperty(regex, "lastIndex", index + (point !== undefined && point > 0xffff ? 2 : 1), budget, true, context);
+                field = undefined;
+            }
+            matched = undefined;
+            current = undefined;
         }
-        else if (token === "'") {
-            result += input.slice(matchIndex + match.length);
+        let copiedThrough = 0;
+        for (current of matches) {
+            field = await readReplacementProperty(current, "length", budget, context);
+            const count = Math.max(normalizeLastIndex(await sandboxNumber(field, budget, context)) - 1, 0);
+            field = await readReplacementProperty(current, "0", budget, context);
+            matched = await sandboxString(field, budget, context);
+            field = await readReplacementProperty(current, "index", budget, context);
+            const number = await sandboxNumber(field, budget, context);
+            const position = Math.min(Math.max(Number.isNaN(number) ? 0 : Math.trunc(number), 0), value.length);
+            field = undefined;
+            captures = [];
+            budget.allocateArrayLength(count);
+            for (let index = 1; index <= count; index++) {
+                budget.visitNode();
+                field = await readReplacementProperty(current, String(index), budget, context);
+                captures.push(field === undefined ? undefined : await sandboxString(field, budget, context));
+                field = undefined;
+            }
+            groups = await readReplacementProperty(current, "groups", budget, context);
+            let text;
+            if (typeof replacement === "string") {
+                if (groups === null)
+                    throw new TypeError("Replacement groups cannot be null.");
+                if (groups !== undefined && typeof groups !== "object") {
+                    groups = createSandboxBox(groups);
+                    budget.chargeDataUsage(measureSandboxData([groups]));
+                }
+                text = await expandReplacement(replacement, matched, captures, value, position, budget, context, groups);
+            }
+            else {
+                const args = [matched, ...captures, position, value];
+                if (groups !== undefined)
+                    args.push(groups);
+                budget.allocateArrayLength(args.length);
+                field = await callClosure(replacement, args);
+                text = await sandboxString(field, budget, context);
+                field = undefined;
+            }
+            if (position >= copiedThrough) {
+                result = budget.allocateString(result + value.slice(copiedThrough, position) + text);
+                copiedThrough = position + matched.length;
+            }
+            matched = undefined;
+            captures = [];
+            groups = undefined;
         }
-        else if (token >= "0" && token <= "9") {
-            let captureIndex = Number(token);
-            const nextDigit = replacement.charAt(index + 2);
-            if (nextDigit >= "0" && nextDigit <= "9") {
-                const twoDigitIndex = Number(token + nextDigit);
-                if (twoDigitIndex > 0 && twoDigitIndex <= captures.length) {
-                    captureIndex = twoDigitIndex;
-                    index += 1;
+        return budget.allocateString(result + value.slice(copiedThrough));
+    }
+    finally {
+        release();
+    }
+}
+async function expandReplacement(replacement, match, captures, input, matchIndex, budget, context, groups) {
+    let result = "";
+    const release = retainValues(budget, () => [replacement, match, captures, input, groups, result]);
+    try {
+        for (let index = 0; index < replacement.length; index += 1) {
+            budget.visitNode();
+            budget.allocateString(result);
+            const character = replacement.charAt(index);
+            if (character !== "$") {
+                result += character;
+                continue;
+            }
+            const token = replacement.charAt(index + 1);
+            if (token === "$") {
+                result += "$";
+            }
+            else if (token === "&") {
+                result += match;
+            }
+            else if (token === "`") {
+                result += input.slice(0, matchIndex);
+            }
+            else if (token === "'") {
+                result += input.slice(matchIndex + match.length);
+            }
+            else if (token === "<" && groups !== undefined) {
+                const end = replacement.indexOf(">", index + 2);
+                if (end === -1) {
+                    result += "$";
+                    continue;
                 }
+                const capture = await readReplacementProperty(groups, replacement.slice(index + 2, end), budget, context);
+                if (capture !== undefined)
+                    result += await sandboxString(capture, budget, context);
+                index = end;
+                continue;
             }
-            if (captureIndex === 0 || captureIndex > captures.length) {
+            else if (token >= "0" && token <= "9") {
+                let captureIndex = Number(token);
+                const nextDigit = replacement.charAt(index + 2);
+                if (nextDigit >= "0" && nextDigit <= "9") {
+                    const twoDigitIndex = Number(token + nextDigit);
+                    if (twoDigitIndex > 0 && twoDigitIndex <= captures.length) {
+                        captureIndex = twoDigitIndex;
+                        index += 1;
+                    }
+                }
+                if (captureIndex === 0 || captureIndex > captures.length) {
+                    result += "$";
+                    continue;
+                }
+                result += captures[captureIndex - 1] ?? "";
+            }
+            else {
                 result += "$";
                 continue;
             }
-            result += captures[captureIndex - 1] ?? "";
-        }
-        else {
-            result += "$";
-            continue;
+            index += 1;
         }
-        index += 1;
+        return budget.allocateString(result);
+    }
+    finally {
+        release();
     }
-    return result;
 }
-async function replaceWithClosure(value, searchValue, replacer, replaceAll, budget, callClosure) {
+async function replaceWithClosure(value, searchValue, replacer, replaceAll, budget, callClosure, context) {
     const offsets = findReplacementOffsets(value, searchValue, replaceAll);
     let result = "";
     let copiedThrough = 0;
-    for (const offset of offsets) {
-        result += value.slice(copiedThrough, offset);
-        result += String(await callClosure(replacer, [searchValue, offset, value]));
-        copiedThrough = offset + searchValue.length;
+    const release = retainValues(budget, () => [value, searchValue, replacer, result]);
+    try {
+        for (const offset of offsets) {
+            result += value.slice(copiedThrough, offset);
+            result += await sandboxString(await callClosure(replacer, [searchValue, offset, value]), budget, context);
+            copiedThrough = offset + searchValue.length;
+        }
+        result += value.slice(copiedThrough);
+        return budget.allocateString(result);
+    }
+    finally {
+        release();
     }
-    result += value.slice(copiedThrough);
-    return budget.allocateString(result);
 }
 function findReplacementOffsets(value, searchValue, replaceAll) {
     const firstOffset = value.indexOf(searchValue);
@@ -402,40 +598,76 @@ function findReplacementOffsets(value, searchValue, replaceAll) {
     }
     return offsets;
 }
-function callSplit(value, args, budget, compilation) {
-    if (args.some(isSandboxClosure))
-        throw new TypeError("String#split does not support function arguments.");
-    if (isSandboxRegex(args[0])) {
-        const regex = args[0];
-        const splitter = createSandboxRegex(regex.source, regex.flags.includes("g") ? regex.flags : `${regex.flags}g`, 0, compilation);
-        const limit = asNumberOrUndefined(args[1]) ?? 2 ** 32 - 1;
-        const result = [];
-        let copiedThrough = 0;
-        let endedWithZeroWidthMatch = false;
-        for (const match of collectRegexMatches(splitter, value, true)) {
-            endedWithZeroWidthMatch = match.text.length === 0 && match.index === value.length;
-            if (match.text.length === 0 &&
-                (match.index === copiedThrough || match.index === value.length))
-                continue;
-            if (result.length >= limit)
-                break;
-            result.push(budget.allocateString(value.slice(copiedThrough, match.index)));
-            for (const capture of match.captures) {
-                if (result.length >= limit)
+function callSplit(value, args, budget, useRegex, parent, context) {
+    const pattern = args[0];
+    let separator;
+    const release = retainValues(budget, () => [value, ...args, separator]);
+    const withLimit = (number) => {
+        const limit = number >>> 0;
+        const converted = useRegex || pattern === undefined ? pattern : sandboxString(pattern, budget, context);
+        const split = (converted) => {
+            separator = converted;
+            return splitNormalized(value, converted, limit, budget, parent);
+        };
+        return converted instanceof Promise ? converted.then(split) : split(converted);
+    };
+    try {
+        const limit = args[1] === undefined ? 2 ** 32 - 1 : sandboxNumber(args[1], budget, context);
+        const result = limit instanceof Promise ? limit.then(withLimit) : withLimit(limit);
+        if (result instanceof Promise)
+            return result.finally(release);
+        release();
+        return result;
+    }
+    catch (error) {
+        release();
+        throw error;
+    }
+}
+function splitNormalized(value, separator, limit, budget, parent) {
+    if (limit === 0)
+        return [];
+    if (isSandboxRegex(separator)) {
+        const regex = separator;
+        const operation = budget.acquireCompileOwner(false, parent?.owner);
+        const compilation = new CompileScope(operation.owner);
+        try {
+            const splitter = createSandboxRegex(regex.source, regex.flags.includes("g") ? regex.flags : `${regex.flags}g`, 0, compilation);
+            const result = [];
+            let copiedThrough = 0;
+            let endedWithZeroWidthMatch = false;
+            while (result.length < limit) {
+                const match = executeRegex(splitter, value, Number(splitter.lastIndex));
+                if (match === null)
                     break;
-                result.push(capture === undefined ? undefined : budget.allocateString(capture));
+                if (match.text.length === 0)
+                    splitter.lastIndex = match.index + 1;
+                endedWithZeroWidthMatch = match.text.length === 0 && match.index === value.length;
+                if (match.text.length === 0 &&
+                    (match.index === copiedThrough || match.index === value.length))
+                    continue;
+                budget.allocateArrayLength(result.length + 1);
+                result.push(budget.allocateString(value.slice(copiedThrough, match.index)));
+                for (const capture of match.captures) {
+                    if (result.length >= limit)
+                        break;
+                    budget.allocateArrayLength(result.length + 1);
+                    result.push(capture === undefined ? undefined : budget.allocateString(capture));
+                }
+                copiedThrough = match.index + match.text.length;
             }
-            copiedThrough = match.index + match.text.length;
+            if (result.length < limit && (value.length > 0 || !endedWithZeroWidthMatch)) {
+                budget.allocateArrayLength(result.length + 1);
+                result.push(budget.allocateString(value.slice(copiedThrough)));
+            }
+            return result;
+        }
+        finally {
+            compilation.dispose();
+            operation.release();
         }
-        if (result.length < limit && (value.length > 0 || !endedWithZeroWidthMatch))
-            result.push(budget.allocateString(value.slice(copiedThrough)));
-        budget.allocateArrayLength(result.length);
-        return result;
     }
-    if (args[0] !== undefined && typeof args[0] !== "string")
-        throw new TypeError(SPLIT_STRING_MESSAGE);
-    const limit = asNumberOrUndefined(args[1]);
-    const result = splitString(value, args[0], limit).map((part) => budget.allocateString(part));
+    const result = splitString(value, separator, limit).map((part) => budget.allocateString(part));
     budget.allocateArrayLength(result.length);
     return result;
 }
@@ -455,20 +687,125 @@ async function callStringPattern(value, methodName, pattern, budget, parent, con
         operation.release();
     }
 }
-async function callStringRegexCursor(value, methodName, regex, budget, parent, context) {
-    const operation = budget.acquireCompileOwner(false, parent?.owner);
-    const compilation = new CompileScope(operation.owner);
-    const cursor = regex.lastIndex;
-    const retained = {};
-    budget.setRetainedValues(retained, () => [value, regex, cursor]);
+export async function regexMatch(input, regex, budget, context) {
+    if (regex === null || typeof regex !== "object")
+        throw new TypeError("RegExp match requires an object receiver.");
+    let value;
+    const matches = [];
+    let result;
+    let matched;
+    let cursor;
+    let flagsValue;
+    let flags;
+    const release = retainValues(budget, () => [input, value, regex, matches, result, matched, cursor, flagsValue, flags]);
+    const read = (target, key) => {
+        if (context?.getProperty !== undefined)
+            return context.getProperty(target, key);
+        const descriptor = getSandboxPropertyDescriptor(target, key, budget);
+        return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, target, context);
+    };
     try {
-        const lastIndex = await sandboxNumber(cursor, budget, context);
-        return callMatchLikeMethod(value, methodName, [regex], compilation, lastIndex);
+        value = await sandboxString(input, budget, context);
+        input = undefined;
+        if (isSandboxRegex(regex) && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
+            release();
+            return await callStringMethodBody(value, "match", [regex], budget, context?.compilation, context);
+        }
+        flagsValue = await read(regex, "flags");
+        flags = await sandboxString(flagsValue, budget, context);
+        flagsValue = undefined;
+        if (!flags.includes("g"))
+            return await regexExec(regex, value, budget, context);
+        const fullUnicode = flags.includes("u") || flags.includes("v");
+        flags = undefined;
+        await setSandboxProperty(regex, "lastIndex", 0, budget, true, context);
+        while (true) {
+            budget.visitNode();
+            result = await regexExec(regex, value, budget, context);
+            if (result === null)
+                return matches.length === 0 ? null : matches;
+            const descriptor = context?.getProperty === undefined
+                ? getSandboxPropertyDescriptor(result, "0", budget) : undefined;
+            matched = await (context?.getProperty !== undefined ? context.getProperty(result, "0")
+                : descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, result, context));
+            const text = await sandboxString(matched, budget, context);
+            matched = undefined;
+            budget.allocateArrayLength(matches.length + 1);
+            matches.push(text);
+            if (text.length === 0) {
+                cursor = await read(regex, "lastIndex");
+                const index = normalizeLastIndex(await sandboxNumber(cursor, budget, context));
+                const point = fullUnicode ? value.codePointAt(index) : undefined;
+                await setSandboxProperty(regex, "lastIndex", index + (point !== undefined && point > 0xffff ? 2 : 1), budget, true, context);
+                cursor = undefined;
+            }
+            result = undefined;
+        }
     }
     finally {
+        release();
+    }
+}
+function callStringRegexCursor(value, methodName, regex, budget, parent, context) {
+    const operation = budget.acquireCompileOwner(false, parent?.owner);
+    const compilation = new CompileScope(operation.owner);
+    let cursor;
+    let flagsValue;
+    let flags;
+    let matcher;
+    const retained = {};
+    budget.setRetainedValues(retained, () => [value, regex, cursor, flagsValue, flags, matcher]);
+    const release = () => {
         budget.setRetainedValues(retained, undefined);
         compilation.dispose();
         operation.release();
+    };
+    const readCursor = () => {
+        cursor = regex.lastIndex;
+        const finish = (lastIndex) => {
+            if (matcher !== undefined) {
+                matcher.lastIndex = normalizeLastIndex(lastIndex);
+                return restoreSandboxRegExpIterator({ matcher, input: value, exhausted: false });
+            }
+            return callMatchLikeMethod(value, methodName, [regex], compilation, lastIndex);
+        };
+        const lastIndex = sandboxNumber(cursor, budget, context);
+        return lastIndex instanceof Promise ? lastIndex.then(finish) : finish(lastIndex);
+    };
+    const clone = (text) => {
+        flags = text;
+        flagsValue = undefined;
+        matcher = createSandboxRegex(regex.source, flags, 0, compilation);
+        flags = undefined;
+        return readCursor();
+    };
+    const convertFlags = (value) => {
+        flagsValue = value;
+        const text = sandboxString(value, budget, context);
+        return text instanceof Promise ? text.then(clone) : clone(text);
+    };
+    try {
+        let result;
+        if (methodName === "matchAll") {
+            const descriptor = context?.getProperty === undefined
+                ? getSandboxPropertyDescriptor(regex, "flags", budget) : undefined;
+            const value = context?.getProperty !== undefined
+                ? context.getProperty(regex, "flags")
+                : descriptor !== undefined
+                    ? readPropertyDescriptor(descriptor, regex, context)
+                    : getRegexMember(regex, "flags", budget, context);
+            result = value instanceof Promise ? value.then(convertFlags) : convertFlags(value);
+        }
+        else
+            result = readCursor();
+        if (result instanceof Promise)
+            return result.finally(release);
+        release();
+        return result;
+    }
+    catch (error) {
+        release();
+        throw error;
     }
 }
 function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
@@ -484,8 +821,6 @@ function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
             regex.lastIndex = lastIndex;
         return match?.index ?? -1;
     }
-    if (methodName === "matchAll" && !regex.flags.includes("g"))
-        throw new TypeError("String#matchAll requires a global regex.");
     if (methodName === "match" && !regex.flags.includes("g"))
         return toMatchArray(executeRegex(regex, value, lastIndex ?? Number(regex.lastIndex)), value);
     if (methodName === "match")
@@ -493,12 +828,10 @@ function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
     const matcher = methodName === "matchAll"
         ? createSandboxRegex(regex.source, regex.flags, normalizeLastIndex(lastIndex ?? Number(regex.lastIndex)), compilation)
         : regex;
-    const matches = collectRegexMatches(matcher, value, true, compilation.owner?.budget, Number(matcher.lastIndex));
-    if (methodName === "match" && matches.length === 0)
-        return null;
-    return methodName === "match"
-        ? matches.map((match) => match.text)
-        : matches.map((match) => toMatchArray(match, value));
+    if (methodName === "matchAll")
+        return restoreSandboxRegExpIterator({ matcher, input: value, exhausted: false });
+    const matches = collectRegexMatches(matcher, value, matcher.flags.includes("g"), compilation.owner?.budget, Number(matcher.lastIndex));
+    return matches.length === 0 ? null : matches.map((match) => match.text);
 }
 function collectRegexMatches(regex, value, all, budget, lastIndex = 0) {
     const matches = [];