Bug 1287525 - Part 1: Do not use RegExp.prototype[@@split] optimized path if |this| object has extra property. r=h4writer
authorTooru Fujisawa <arai_a@mac.com>
Fri, 29 Jul 2016 13:55:26 +0900
changeset 332275 1b77ef6ac23ea2fc57246036dc7ae4dca98dbb19
parent 332274 f099a449488b2b277dc5488d9f8a37272c6cd792
child 332276 75976803569d9626c1ac5f495a69b0936321ed9e
push id9858
push userjlund@mozilla.com
push dateMon, 01 Aug 2016 14:37:10 +0000
treeherdermozilla-aurora@203106ef6cb6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1287525
milestone50.0a1
Bug 1287525 - Part 1: Do not use RegExp.prototype[@@split] optimized path if |this| object has extra property. r=h4writer
js/src/builtin/RegExp.js
js/src/tests/ecma_6/RegExp/split-prop-access.js
--- a/js/src/builtin/RegExp.js
+++ b/js/src/builtin/RegExp.js
@@ -574,16 +574,17 @@ function IsRegExpSplitOptimizable(rx, C)
     var RegExpCtor = GetBuiltinConstructor("RegExp");
     if (C !== RegExpCtor)
         return false;
 
     var RegExpProto = RegExpCtor.prototype;
     // If RegExpPrototypeOptimizable succeeds, `RegExpProto.exec` is guaranteed
     // to be a data property.
     return RegExpPrototypeOptimizable(RegExpProto) &&
+           RegExpInstanceOptimizable(rx, RegExpProto) &&
            RegExpProto.exec === RegExp_prototype_Exec;
 }
 
 // ES 2016 draft Mar 25, 2016 21.2.5.11.
 function RegExpSplit(string, limit) {
     // Step 1.
     var rx = this;
 
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/split-prop-access.js
@@ -0,0 +1,19 @@
+var BUGNUMBER = 1287525;
+var summary = 'String.prototype.split should call ToUint32(limit) before ToString(separator).';
+
+print(BUGNUMBER + ": " + summary);
+
+var accessed = false;
+
+var rx = /a/;
+Object.defineProperty(rx, Symbol.match, {
+  get() {
+    accessed = true;
+  }
+});
+rx[Symbol.split]("abba");
+
+assertEq(accessed, true);
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);