Fix panic in regex execution (#1283)

* Fix panic with regex exec

* Add toLength comment

boa/src/builtins/regexp/mod.rs

@@ -466,7 +466,8 @@ impl RegExp {
     /// [spec]: https://tc39.es/ecma262/#sec-regexp.prototype.test
     /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/test
     pub(crate) fn test(this: &Value, args: &[Value], context: &mut Context) -> Result<Value> {
-        let mut last_index = this.get_field("lastIndex", context)?.to_index(context)?;
+        // 22.2.5.2.2.4 really says to use "toLength" and not "toIndex"
+        let mut last_index = this.get_field("lastIndex", context)?.to_length(context)?;
         let result = if let Some(object) = this.as_object() {
             // 3. Let string be ? ToString(S).
             let arg_str = args
@@ -520,7 +521,8 @@ impl RegExp {
     /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/exec
     pub(crate) fn exec(this: &Value, args: &[Value], context: &mut Context) -> Result<Value> {
         // 4. Return ? RegExpBuiltinExec(R, S).
-        let mut last_index = this.get_field("lastIndex", context)?.to_index(context)?;
+        // 22.2.5.2.2.4 really says to use "toLength" and not "toIndex"
+        let mut last_index = this.get_field("lastIndex", context)?.to_length(context)?;
         let result = if let Some(object) = this.as_object() {
             let object = object.borrow();
             if let Some(regex) = object.as_regexp() {
@@ -532,7 +534,14 @@ impl RegExp {
                     .to_string(context)?;
 
                 let result = {
-                    if let Some(m) = regex.matcher.find_from(arg_str.as_str(), last_index).next() {
+                    if last_index > arg_str.len() {
+                        if regex.use_last_index {
+                            last_index = 0;
+                        }
+                        Value::null()
+                    } else if let Some(m) =
+                        regex.matcher.find_from(arg_str.as_str(), last_index).next()
+                    {
                         if regex.use_last_index {
                             last_index = m.end();
                         }