Bug 1268056 - Check if |this| value is a RegExp object in the optimized path in RegExpSplit. r=h4writer, a=lizzard
authorTooru Fujisawa <arai_a@mac.com>
Sat, 30 Apr 2016 02:22:38 +0900
changeset 332659 e11c1544850eefb58ab1364d9858d00c1e4b26a7
parent 332658 22166e1f14d2f6264eba026f97e6776e6bacedc0
child 332660 09af2f25cbe6de5e712b797f67c989f0a8dacf8c
push id6048
push userkmoir@mozilla.com
push dateMon, 06 Jun 2016 19:02:08 +0000
treeherdermozilla-beta@46d72a56c57d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer, lizzard
bugs1268056
milestone48.0a2
Bug 1268056 - Check if |this| value is a RegExp object in the optimized path in RegExpSplit. r=h4writer, a=lizzard
js/src/builtin/RegExp.js
js/src/tests/ecma_6/RegExp/split-obj.js
--- a/js/src/builtin/RegExp.js
+++ b/js/src/builtin/RegExp.js
@@ -560,17 +560,20 @@ function RegExpSearch(string) {
     // Step 8.
     if (result === null)
         return -1;
 
     // Step 9.
     return result.index;
 }
 
-function IsRegExpSplitOptimizable(C) {
+function IsRegExpSplitOptimizable(rx, C) {
+    if (!IsRegExpObject(rx))
+        return false;
+
     var RegExpCtor = GetBuiltinConstructor("RegExp");
     if (C !== RegExpCtor)
         return false;
 
     var RegExpProto = RegExpCtor.prototype;
     // If RegExpPrototypeOptimizable succeeds, `RegExpProto.exec` is guaranteed
     // to be a data property.
     return RegExpPrototypeOptimizable(RegExpProto) &&
@@ -596,17 +599,17 @@ function RegExpSplit(string, limit) {
     var flags = ToString(rx.flags);
 
     // Steps 6-7.
     var unicodeMatching = callFunction(std_String_includes, flags, "u");
 
     // Step 14 (reordered).
     var size = S.length;
 
-    var optimizable = IsRegExpSplitOptimizable(C);
+    var optimizable = IsRegExpSplitOptimizable(rx, C);
     var splitter;
     if (optimizable && size !== 0) {
         // Steps 8-9 (skipped).
 
         // Step 10.
         // If split operation is optimizable, perform non-sticky match.
         splitter = regexp_construct_no_sticky(rx, flags);
     } else {
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/split-obj.js
@@ -0,0 +1,12 @@
+var BUGNUMBER = 887016;
+var summary = "RegExp.prototype[@@split] should check if this value is RegExp.";
+
+print(BUGNUMBER + ": " + summary);
+
+var obj = { flags: "", toString: () => "-" };
+assertDeepEq(RegExp.prototype[Symbol.split].call(obj, "a-b-c"),
+             ["a", "b", "c"]);
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
+