right now the algorithm for String.prototype.replace reads:
4. Let replacer be GetMethod(O, @@replace).
5. ReturnIfAbrupt(replacer).
6. If replacer is not undefined, then
a. Return Call(replacer, searchValue, «string, replaceValue»).
With those steps there's no way for the RegExp.prototype[@@replace] code to be called in, e.g. this code:
var re = /hello/;
console.log ("hello, world".replace (re, "goodbye"));
Given that searchValue is passed as the 'this' to replacer, it seems like it @@replace should be looked up on searchValue. i.e.:
4. Let replacer be GetMethod(searchValue, @@replace)
*** This bug has been marked as a duplicate of bug 3425 ***