From 97e8046e444da3e7e4729aa1ee5a4f86d56f69d0 Mon Sep 17 00:00:00 2001
From: littledan <littledan@chromium.org>
Date: Fri, 8 Jul 2016 09:50:05 -0700
Subject: [PATCH] Avoid calling the builtin String.prototype.split in Intl

The Intl code previously called the initial value of String.prototype.split
for some internal operations. However, this did not have the intended effect
as Intl only needs to split strings by strings, but String.prototype.split
has integration with Symbol.split for RegExps.

This patch replaces the calls of StringSplit in the Intl implementation
with direct calls to the %StringSplit runtime function to avoid the issue.

R=yangguo@chromium.org
BUG=v8:5179

Review-Url: https://codereview.chromium.org/2126073002
Cr-Commit-Position: refs/heads/master@{#37615}
---
 src/js/i18n.js            | 12 +++++-------
 test/intl/regress-5179.js | 15 +++++++++++++++
 2 files changed, 20 insertions(+), 7 deletions(-)
 create mode 100644 test/intl/regress-5179.js

diff --git a/src/js/i18n.js b/src/js/i18n.js
index dd85a05264..37706877f0 100644
--- a/src/js/i18n.js
+++ b/src/js/i18n.js
@@ -41,7 +41,6 @@ var resolvedSymbol = utils.ImportNow("intl_resolved_symbol");
 var SetFunctionName = utils.SetFunctionName;
 var StringIndexOf;
 var StringLastIndexOf;
-var StringSplit;
 var StringSubstr;
 var StringSubstring;
 
@@ -57,7 +56,6 @@ utils.Import(function(from) {
   InternalRegExpReplace = from.InternalRegExpReplace;
   StringIndexOf = from.StringIndexOf;
   StringLastIndexOf = from.StringLastIndexOf;
-  StringSplit = from.StringSplit;
   StringSubstr = from.StringSubstr;
   StringSubstring = from.StringSubstring;
 });
@@ -477,7 +475,7 @@ function bestFitMatcher(service, requestedLocales) {
  * We are not concerned with the validity of the values at this point.
  */
 function parseExtension(extension) {
-  var extensionSplit = %_Call(StringSplit, extension, '-');
+  var extensionSplit = %StringSplit(extension, '-', kMaxUint32);
 
   // Assume ['', 'u', ...] input, but don't throw.
   if (extensionSplit.length <= 2 ||
@@ -711,7 +709,7 @@ function toTitleCaseTimezoneLocation(location) {
     // The first character is a separator, '_' or '-'.
     // None of IANA zone names has both '_' and '-'.
     var separator = %_Call(StringSubstring, match[2], 0, 1);
-    var parts = %_Call(StringSplit, match[2], separator);
+    var parts = %StringSplit(match[2], separator, kMaxUint32);
     for (var i = 1; i < parts.length; i++) {
       var part = parts[i]
       var lowercasedPart = %StringToLowerCase(part);
@@ -812,14 +810,14 @@ function isValidLanguageTag(locale) {
   // Check if there are any duplicate variants or singletons (extensions).
 
   // Remove private use section.
-  locale = %_Call(StringSplit, locale, '-x-')[0];
+  locale = %StringSplit(locale, '-x-', kMaxUint32)[0];
 
   // Skip language since it can match variant regex, so we start from 1.
   // We are matching i-klingon here, but that's ok, since i-klingon-klingon
   // is not valid and would fail LANGUAGE_TAG_RE test.
   var variants = new InternalArray();
   var extensions = new InternalArray();
-  var parts = %_Call(StringSplit, locale, '-');
+  var parts = %StringSplit(locale, '-', kMaxUint32);
   for (var i = 1; i < parts.length; i++) {
     var value = parts[i];
     if (!IS_NULL(InternalRegExpMatch(GetLanguageVariantRE(), value)) &&
@@ -1805,7 +1803,7 @@ function canonicalizeTimeZoneID(tzID) {
                toTitleCaseTimezoneLocation(match[2]);
 
   if (!IS_UNDEFINED(match[3]) && 3 < match.length) {
-    var locations = %_Call(StringSplit, match[3], '/');
+    var locations = %StringSplit(match[3], '/', kMaxUint32);
     // The 1st element is empty. Starts with i=1.
     for (var i = 1; i < locations.length; i++) {
       result = result + '/' + toTitleCaseTimezoneLocation(locations[i]);
diff --git a/test/intl/regress-5179.js b/test/intl/regress-5179.js
new file mode 100644
index 0000000000..c9132c0e99
--- /dev/null
+++ b/test/intl/regress-5179.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(String.prototype, Symbol.split, {
+    get() {
+        return function(obj, limit) {
+            return [, null];
+        }
+    }
+});
+
+dtf = new Intl.DateTimeFormat("de", {timeZone:"America/bueNos_airES"});
+
+assertEquals("America/Buenos_Aires", dtf.resolvedOptions().timeZone);