AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[regexp] Fix fast/slow-path dispatch in RegExp.p.get flags

Browse Source 
Flag getters (e.g. RegExp.p.get global) are defined on the prototype and
thus we need to use the more general BranchIfFastRegExp here instead of
IsFastRegExpNoPrototype.

Bug: chromium:800538
Change-Id: Ib6bc8a4fd3bf2f7dd31538c8dbb61814106c184b
Reviewed-on: https://chromium-review.googlesource.com/859767
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50538}
This commit is contained in:
Jakob Gruber 2018-01-10 14:52:14 +01:00 committed by Commit Bot
parent c36bbaafc8
commit 4e14a2a4e6
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/builtins/builtins-regexp-gen.cc
View File

@ -1219,8 +1219,7 @@ TF_BUILTIN(RegExpPrototypeFlagsGetter, RegExpBuiltinsAssembler) {
Node* const receiver = maybe_receiver;
Label if_isfastpath(this), if_isslowpath(this, Label::kDeferred);
Branch(IsFastRegExpNoPrototype(context, receiver, map), &if_isfastpath,
&if_isslowpath);
BranchIfFastRegExp(context, receiver, map, &if_isfastpath, &if_isslowpath);
BIND(&if_isfastpath);
Return(FlagsGetter(context, receiver, true));

6
test/mjsunit/regress/regress-800538.js Normal file
View File

@ -0,0 +1,6 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
RegExp.prototype.__defineGetter__("global", () => true);
assertEquals("/()/g", /()/.toString());