Bug 1287524 - Check RegExp.prototype.unicode in RegExpPrototypeOptimizable. r=h4writer
authorTooru Fujisawa <arai_a@mac.com>
Fri, 29 Jul 2016 13:55:26 +0900
changeset 347240 f099a449488b2b277dc5488d9f8a37272c6cd792
parent 347239 18642055568111041c5b099b66209824b330b74e
child 347241 1b77ef6ac23ea2fc57246036dc7ae4dca98dbb19
push id6389
push userraliiev@mozilla.com
push dateMon, 19 Sep 2016 13:38:22 +0000
treeherdermozilla-beta@01d67bfe6c81 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1287524
milestone50.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1287524 - Check RegExp.prototype.unicode in RegExpPrototypeOptimizable. r=h4writer
js/src/builtin/RegExp.cpp
js/src/tests/ecma_6/RegExp/replace-global-unicode.js
js/src/vm/RegExpObject.h
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -1554,16 +1554,25 @@ js::RegExpPrototypeOptimizableRaw(JSCont
     if (!GetOwnNativeGetterPure(cx, proto, NameToId(cx->names().sticky), &stickyGetter))
         return false;
 
     if (stickyGetter != regexp_sticky) {
         *result = false;
         return true;
     }
 
+    JSNative unicodeGetter;
+    if (!GetOwnNativeGetterPure(cx, proto, NameToId(cx->names().unicode), &unicodeGetter))
+        return false;
+
+    if (unicodeGetter != regexp_unicode) {
+        *result = false;
+        return true;
+    }
+
     // Check if @@match, @@search, and exec are own data properties,
     // those values should be tested in selfhosted JS.
     bool has = false;
     if (!HasOwnDataPropertyPure(cx, proto, SYMBOL_TO_JSID(cx->wellKnownSymbols().match), &has))
         return false;
     if (!has) {
         *result = false;
         return true;
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/replace-global-unicode.js
@@ -0,0 +1,18 @@
+var BUGNUMBER = 1287524;
+var summary = 'RegExp.prototype[@@replace] should not use optimized path if RegExp.prototype.unicode is modified.';
+
+print(BUGNUMBER + ": " + summary);
+
+Object.defineProperty(RegExp.prototype, "unicode", {
+  get() {
+    RegExp.prototype.exec = () => null;
+  }
+});
+
+var rx = RegExp("a", "g");
+var s = "abba";
+var r = rx[Symbol.replace](s, "c");
+assertEq(r, "abba");
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -321,16 +321,17 @@ class RegExpCompartment
      * the input/index properties faster.
      */
     ReadBarriered<ArrayObject*> matchResultTemplateObject_;
 
     /*
      * The shape of RegExp.prototype object that satisfies following:
      *   * RegExp.prototype.global getter is not modified
      *   * RegExp.prototype.sticky getter is not modified
+     *   * RegExp.prototype.unicode getter is not modified
      *   * RegExp.prototype.exec is an own data property
      *   * RegExp.prototype[@@match] is an own data property
      *   * RegExp.prototype[@@search] is an own data property
      */
     ReadBarriered<Shape*> optimizableRegExpPrototypeShape_;
 
     /*
      * The shape of RegExp instance that satisfies following: