Fix bug in string replace regexp with function when returning non-string.

Review URL: http://codereview.chromium.org/1528005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/string.js

@@ -450,7 +450,9 @@ function StringReplaceRegExpWithFunction(subject, regexp, replace) {
             }
           } else {
             var func_result = replace.call(null, elem, match_start, subject);
-            if (!IS_STRING(func_result)) func_result = TO_STRING(func_result);
+            if (!IS_STRING(func_result)) {
+              func_result = NonStringToString(func_result);
+            }
             res[i] = func_result;
             match_start += elem.length;
           }
@@ -464,7 +466,9 @@ function StringReplaceRegExpWithFunction(subject, regexp, replace) {
             // Use the apply argument as backing for global RegExp properties.
             lastMatchInfoOverride = elem;
             var func_result = replace.apply(null, elem);
-            if (!IS_STRING(func_result)) func_result = TO_STRING(func_result);
+            if (!IS_STRING(func_result)) {
+              func_result = NonStringToString(func_result);
+            }
             res[i] = func_result;
           }
           i++;

test/mjsunit/string-replace.js

@@ -180,3 +180,11 @@ longstring = longstring + longstring;
 
 replaceTest(longstring + longstring, 
             "<" + longstring + ">", /<(.*)>/g, "$1$1");
+            
+replaceTest("string 42", "string x", /x/g, function() { return 42; });
+replaceTest("string 42", "string x", /x/, function() { return 42; });            
+replaceTest("string 42", "string x", /[xy]/g, function() { return 42; });
+replaceTest("string 42", "string x", /[xy]/, function() { return 42; });
+replaceTest("string true", "string x", /x/g, function() { return true; });
+replaceTest("string null", "string x", /x/g, function() { return null; });
+replaceTest("string undefined", "string x", /x/g, function() { return undefined; });