Bug 1268056 - Check if |this| value is a RegExp object in the optimized path in RegExpSplit. r=h4writer
authorTooru Fujisawa <arai_a@mac.com>
Sat, 30 Apr 2016 02:22:38 +0900
changeset 334467 1d4795f0b4e28db3ddf6a5751653c179fef68726
parent 334466 a48fafcdd36fe7c618e0a82f26ae801e00ede30d
child 334468 6ce48a7c22d55187daa471ff10d136b7ab02a5ee
child 334518 9e97e2282142b206ef97d13045eac502b58201ed
push id6249
push userjlund@mozilla.com
push dateMon, 01 Aug 2016 13:59:36 +0000
treeherdermozilla-beta@bad9d4f5bf7e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1268056
milestone49.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1268056 - Check if |this| value is a RegExp object in the optimized path in RegExpSplit. r=h4writer
js/src/builtin/RegExp.js
js/src/tests/ecma_6/RegExp/split-obj.js
--- a/js/src/builtin/RegExp.js
+++ b/js/src/builtin/RegExp.js
@@ -560,17 +560,20 @@ function RegExpSearch(string) {
     // Step 8.
     if (result === null)
         return -1;
 
     // Step 9.
     return result.index;
 }
 
-function IsRegExpSplitOptimizable(C) {
+function IsRegExpSplitOptimizable(rx, C) {
+    if (!IsRegExpObject(rx))
+        return false;
+
     var RegExpCtor = GetBuiltinConstructor("RegExp");
     if (C !== RegExpCtor)
         return false;
 
     var RegExpProto = RegExpCtor.prototype;
     // If RegExpPrototypeOptimizable succeeds, `RegExpProto.exec` is guaranteed
     // to be a data property.
     return RegExpPrototypeOptimizable(RegExpProto) &&
@@ -596,17 +599,17 @@ function RegExpSplit(string, limit) {
     var flags = ToString(rx.flags);
 
     // Steps 6-7.
     var unicodeMatching = callFunction(std_String_includes, flags, "u");
 
     // Step 14 (reordered).
     var size = S.length;
 
-    var optimizable = IsRegExpSplitOptimizable(C);
+    var optimizable = IsRegExpSplitOptimizable(rx, C);
     var splitter;
     if (optimizable && size !== 0) {
         // Steps 8-9 (skipped).
 
         // Step 10.
         // If split operation is optimizable, perform non-sticky match.
         splitter = regexp_construct_no_sticky(rx, flags);
     } else {
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/split-obj.js
@@ -0,0 +1,12 @@
+var BUGNUMBER = 887016;
+var summary = "RegExp.prototype[@@split] should check if this value is RegExp.";
+
+print(BUGNUMBER + ": " + summary);
+
+var obj = { flags: "", toString: () => "-" };
+assertDeepEq(RegExp.prototype[Symbol.split].call(obj, "a-b-c"),
+             ["a", "b", "c"]);
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
+