--- a/js/src/builtin/RegExp.js
+++ b/js/src/builtin/RegExp.js
@@ -276,42 +276,35 @@ function RegExpReplace(string, replaceVa
     if (IsRegExpMethodOptimizable(rx)) {
         var flags = UnsafeGetInt32FromReservedSlot(rx, REGEXP_FLAGS_SLOT);
 
         // Step 7.
         var global = !!(flags & REGEXP_GLOBAL_FLAG);
 
         // Steps 8-16.
         if (global) {
-            // Step 8.a.
-            var fullUnicode = !!(flags & REGEXP_UNICODE_FLAG);
-
             if (functionalReplace) {
                 // For large strings check if the replacer function is
                 // applicable for the elem-base optimization.
                 if (lengthS > 5000) {
                     var elemBase = GetElemBaseForLambda(replaceValue);
                     if (IsObject(elemBase)) {
-                        return RegExpGlobalReplaceOptElemBase(rx, S, lengthS, replaceValue,
-                                                              fullUnicode, elemBase);
+                        return RegExpGlobalReplaceOptElemBase(rx, S, lengthS, replaceValue, flags,
+                                                              elemBase);
                     }
                 }
-                return RegExpGlobalReplaceOptFunc(rx, S, lengthS, replaceValue,
-                                                  fullUnicode);
+                return RegExpGlobalReplaceOptFunc(rx, S, lengthS, replaceValue, flags);
             }
             if (firstDollarIndex !== -1) {
-                return RegExpGlobalReplaceOptSubst(rx, S, lengthS, replaceValue,
-                                                   fullUnicode, firstDollarIndex);
+                return RegExpGlobalReplaceOptSubst(rx, S, lengthS, replaceValue, flags,
+                                                   firstDollarIndex);
             }
-            if (lengthS < 0x7fff) {
-                return RegExpGlobalReplaceShortOpt(rx, S, lengthS, replaceValue,
-                                                   fullUnicode);
-            }
-            return RegExpGlobalReplaceOpt(rx, S, lengthS, replaceValue,
-                                          fullUnicode);
+            if (lengthS < 0x7fff)
+                return RegExpGlobalReplaceShortOpt(rx, S, lengthS, replaceValue, flags);
+            return RegExpGlobalReplaceOpt(rx, S, lengthS, replaceValue, flags);
         }
 
         if (functionalReplace)
             return RegExpLocalReplaceOptFunc(rx, S, lengthS, replaceValue);
         if (firstDollarIndex !== -1)
             return RegExpLocalReplaceOptSubst(rx, S, lengthS, replaceValue, firstDollarIndex);
         if (lengthS < 0x7fff)
             return RegExpLocalReplaceOptShort(rx, S, lengthS, replaceValue);
@@ -532,18 +525,21 @@ function RegExpGetFunctionalReplacement(
 }
 
 // ES 2017 draft rev 03bfda119d060aca4099d2b77cf43f6d4f11cfa2 21.2.5.8
 // steps 8.b-16.
 // Optimized path for @@replace with the following conditions:
 //   * global flag is true
 //   * S is a short string (lengthS < 0x7fff)
 //   * replaceValue is a string without "$"
-function RegExpGlobalReplaceShortOpt(rx, S, lengthS, replaceValue, fullUnicode)
+function RegExpGlobalReplaceShortOpt(rx, S, lengthS, replaceValue, flags)
 {
+    // Step 8.a.
+    var fullUnicode = !!(flags & REGEXP_UNICODE_FLAG);
+
     // Step 8.b.
     var lastIndex = 0;
     rx.lastIndex = 0;
 
     // Step 12 (reordered).
     var accumulatedResult = "";
 
     // Step 13 (reordered).

--- a/js/src/builtin/RegExpGlobalReplaceOpt.h.js
+++ b/js/src/builtin/RegExpGlobalReplaceOpt.h.js
@@ -13,34 +13,37 @@
 //   * ELEMBASE         -- replaceValue is a function that returns an element
 //                         of an object
 //   * none of above    -- replaceValue is a string without "$"
 
 // ES 2017 draft 03bfda119d060aca4099d2b77cf43f6d4f11cfa2 21.2.5.8
 // steps 8.b-16.
 // Optimized path for @@replace with the following conditions:
 //   * global flag is true
-function FUNC_NAME(rx, S, lengthS, replaceValue, fullUnicode
+function FUNC_NAME(rx, S, lengthS, replaceValue, flags
 #ifdef SUBSTITUTION
                    , firstDollarIndex
 #endif
 #ifdef ELEMBASE
                    , elemBase
 #endif
                   )
 {
+    // Step 8.a.
+    var fullUnicode = !!(flags & REGEXP_UNICODE_FLAG);
+
     // Step 8.b.
     var lastIndex = 0;
     rx.lastIndex = 0;
 
 #if defined(FUNCTIONAL) || defined(ELEMBASE)
     // Save the original source and flags, so we can check if the replacer
     // function recompiled the regexp.
     var originalSource = UnsafeGetStringFromReservedSlot(rx, REGEXP_SOURCE_SLOT);
-    var originalFlags = UnsafeGetInt32FromReservedSlot(rx, REGEXP_FLAGS_SLOT);
+    var originalFlags = flags;
 #endif
 
     // Step 12 (reordered).
     var accumulatedResult = "";
 
     // Step 13 (reordered).
     var nextSourcePosition = 0;
 

--- a/js/src/builtin/RegExpLocalReplaceOpt.h.js
+++ b/js/src/builtin/RegExpLocalReplaceOpt.h.js
@@ -87,17 +87,17 @@ function FUNC_NAME(rx, S, lengthS, repla
 
     // Step 14.d.
     var matchLength = matched.length;
 
     // Step 14.e-f.
     var position = result.index;
 
     // Step 14.l.iii (reordered)
-    // To set rx.lastIndex before RegExpGetComplexReplacement.
+    // To set rx.lastIndex before RegExpGetFunctionalReplacement.
     var nextSourcePosition = position + matchLength;
 #else
     // Steps 14.a-d (skipped).
 
     // Step 14.e-f.
     var position = result & 0x7fff;
 
     // Step 14.l.iii (reordered)