--- a/js/src/builtin/RegExp.js
+++ b/js/src/builtin/RegExp.js
@@ -742,17 +742,20 @@ function RegExpSplit(string, limit) {
                 return A;
         }
 
         // Step 19.d.iv.11.
         q = p;
     }
 
     // Steps 20-22.
-    _DefineDataProperty(A, lengthA, Substring(S, p, size - p));
+    if (p >= size)
+        _DefineDataProperty(A, lengthA, "");
+    else
+        _DefineDataProperty(A, lengthA, Substring(S, p, size - p));
 
     // Step 23.
     return A;
 }
 
 // ES6 21.2.5.2.
 // NOTE: This is not RegExpExec (21.2.5.2.1).
 function RegExp_prototype_Exec(string) {

new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/split-invalid-lastIndex.js
@@ -0,0 +1,31 @@
+var BUGNUMBER = 1263851;
+var summary = "RegExp.prototype[@@split] should handle if lastIndex is out of bound.";
+
+print(BUGNUMBER + ": " + summary);
+
+var myRegExp = {
+    get constructor() {
+        return {
+            get [Symbol.species]() {
+                return function() {
+                    return {
+                        get lastIndex() {
+                            return 9;
+                        },
+                        set lastIndex(v) {},
+                        exec() {
+                            return [];
+                        }
+                    };
+                };
+            }
+        };
+    }
+};
+var result = RegExp.prototype[Symbol.split].call(myRegExp, "abcde");;
+assertEq(result.length, 2);
+assertEq(result[0], "");
+assertEq(result[1], "");
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);