Fix the this argument passed to string replace callbacks.

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg@inf.u-szeged.hu

jerry-core/ecma/builtin-objects/ecma-builtin-string-prototype.cpp

@@ -1045,7 +1045,7 @@ ecma_builtin_string_prototype_object_replace_get_string (ecma_builtin_replace_se
 
       ECMA_TRY_CATCH (result_value,
                       ecma_op_function_call_array_args (context_p->replace_function_p,
-                                                        context_p->regexp_or_search_string,
+                                                        ecma_make_simple_value (ECMA_SIMPLE_VALUE_UNDEFINED),
                                                         arguments_list,
                                                         match_length + 2),
                       ret_value);

tests/jerry/string-prototype-replace.js

@@ -72,6 +72,24 @@ catch (e)
 assert ("\ud801\udc00".replace("\ud801", "#") === "#\udc00");
 assert ("\ud801\udc00".replace("\udc00", "#") === "\ud801#");
 
+var global = this;
+
+function case1()
+{
+  assert(this === global);
+  return "y";
+}
+
+function case2()
+{
+  "use strict";
+  assert(this === undefined);
+  return "y";
+}
+
+assert ("x".replace("x", case1) === "y");
+assert ("x".replace("x", case2) === "y");
+
 var regexp = /r/g;
 
 Object.defineProperty(regexp, "lastIndex", {