lib: avoid unsafe String methods that depend on RegExp prototype methods

[ExE-Boss]

The string prototype methods that take RegExp arguments depend on the following properties not being mutated by user code:

The String.prototype method	depends on the RegExp.prototype method
String.prototype.match	RegExp.prototype[Symbol.match], which depends on RegExp.prototype.exec
String.prototype.matchAll	RegExp.prototype[Symbol.matchAll], which depends on %RegExpStringIteratorPrototype%
String.prototype.replace	RegExp.prototype[Symbol.replace]
String.prototype.replaceAll	RegExp.prototype[Symbol.replace]
String.prototype.search	RegExp.prototype[Symbol.search]
String.prototype.split	RegExp.prototype[Symbol.split]

Note that the string‑taking overloads are safe‑ish.

---

Alternatively, it might be a good idea to create SafeRegExp.

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

[aduh95]

Can you split this into several PRs? It would make reviewing and benchmarking easier.

[aduh95]

String.prototype.replaceAll is not available to primordials because it can be disabled by --no-harmony-string-replaceall

[aduh95]

Note that StringPrototypeReplaceAll is still relying on %StringPrototype%[@@replace] being undefined.

// User-land
RegExp.prototype[Symbol.replace] = () => 'foo';
String.prototype[Symbol.replace] = () => 'baz';
// Core
console.log(StringPrototypeReplace('ber', /e/, 'a')); // 'foo'
console.log(StringPrototypeReplace('ber', 'e', 'a')); // 'baz'
console.log(StringPrototypeReplaceAll('beer', 'e', 'a')); // 'baz'
console.log(RegExpPrototypeSymbolReplace(/e/, 'ber', 'a')); // 'bar'
console.log(RegExpPrototypeSymbolReplace(/e/g, 'beer', 'a')); // 'baar'

It's hard to predict if having a RegEx is worth it performance wise, but it's something we should have in mind.

[ExE-Boss]

Superseded by #43393 and #43475.