Catch non-string subject in RegExpExecStub.

src/x64/code-stubs-x64.cc

Index: src/x64/code-stubs-x64.cc
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index 19326f2775ea2e7205015243eb96291c006d3107..958e3ebe0d703cdf8d4c3b732155eab1f966114a 100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -2654,6 +2654,7 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
   __ andb(rbx, Immediate(kIsNotStringMask | kStringRepresentationMask));
   __ j(zero, &seq_ascii_string, Label::kNear);
 
+  // rbx: whether subject is a string and if yes, its string representation
   // Check for flat cons string or sliced string.
   // A flat cons string is a cons string where the second part is the empty
   // string. In that case the subject string is just the first part of the cons
@@ -2663,10 +2664,16 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
   Label cons_string, check_encoding;
   STATIC_ASSERT(kConsStringTag < kExternalStringTag);
   STATIC_ASSERT(kSlicedStringTag > kExternalStringTag);
+  STATIC_ASSERT(kIsNotStringMask > kExternalStringTag);
   __ cmpq(rbx, Immediate(kExternalStringTag));
   __ j(less, &cons_string, Label::kNear);
   __ j(equal, &runtime);
 
+  // Catch non-string subject (should already have been guarded against).
+  STATIC_ASSERT(kIsNotStringTag != 0);
+  __ testb(rbx, Immediate(kIsNotStringMask));
+  __ j(not_zero, &runtime);
+
   // String is sliced.
   __ SmiToInteger32(r14, FieldOperand(rdi, SlicedString::kOffsetOffset));
   __ movq(rdi, FieldOperand(rdi, SlicedString::kParentOffset));