diff --git a/src/builtins/builtins-regexp-gen.cc b/src/builtins/builtins-regexp-gen.cc
index 0999356326..392c60d90e 100644
--- a/src/builtins/builtins-regexp-gen.cc
+++ b/src/builtins/builtins-regexp-gen.cc
@@ -1875,10 +1875,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
             Node* const result_fixed_array = LoadElements(result);
             Node* const match = LoadFixedArrayElement(result_fixed_array, 0);
 
-            // The match is guaranteed to be a string on the fast path.
-            CSA_ASSERT(this, IsString(match));
-
-            var_match.Bind(match);
+            var_match.Bind(ToString_Inline(context, match));
             Goto(&if_didmatch);
           }
 
diff --git a/test/mjsunit/regress/regress-crbug-831943.js b/test/mjsunit/regress/regress-crbug-831943.js
new file mode 100644
index 0000000000..b69da06655
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-831943.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class MyRegExp extends RegExp {
+  exec(str) {
+    const r = super.exec.call(this, str);
+    if (r) r[0] = 0;
+    return r;
+  }
+}
+
+const result = 'a'.match(new MyRegExp('.', 'g'));
+assertArrayEquals(result, ['0']);