[regexp] Don't cache exec method in Regexp.proto[@@split]

src/js/regexp.js

Index: src/js/regexp.js
diff --git a/src/js/regexp.js b/src/js/regexp.js
index 396b694ea65a35a03292a2a0d964690297121397..266d6b6c529e62a4a31a034982f77c28f3b0ff32 100644
--- a/src/js/regexp.js
+++ b/src/js/regexp.js
@@ -344,9 +344,8 @@ function RegExpSubclassSplit(string, limit) {
 
   // TODO(adamk): this fast path is wrong as we doesn't ensure that 'exec'
   // is actually a data property on RegExp.prototype.
-  var exec;
   if (IS_REGEXP(this) && constructor === GlobalRegExp) {
-    exec = this.exec;
+    var exec = this.exec;

[Dan Ehrenberg, 2016/09/26 14:16:27]

Doesn't this initial, additional read of exec violate the spec in a new way
(e.g. if exec is a getter)?

[jgruber, 2016/09/26 14:19:37]

I'm not sure which additional read you mean? This is identical to OLD except
that 'var exec' has been removed from line 347.

     if (exec === RegExpExecJS) {
       return %_Call(RegExpSplit, this, string, limit);
     }
@@ -371,9 +370,7 @@ function RegExpSubclassSplit(string, limit) {
   var stringIndex = prevStringIndex;
   while (stringIndex < size) {
     splitter.lastIndex = stringIndex;
-    result = RegExpSubclassExec(splitter, string, exec);
-    // Ensure exec will be read again on the next loop through.
-    exec = UNDEFINED;
+    result = RegExpSubclassExec(splitter, string);

[Dan Ehrenberg, 2016/09/26 14:30:33]

By not passing exec here, an additional read of exec is caused on the first
iteration. The initial read into the exec variable is synthetic, to be able to
do the fast path. It is observable, but we make up for it by using that value.

A path to recovering correctness would be to call a function to check that exec
is a data property (and the receiver is not a Proxy) and falling back to the
slow path otherwise, before reading the exec property.

[jgruber, 2016/09/26 14:57:23]

I see.

But do we care about the additional exec read? It already violated the spec in
that it was read at the beginning of split instead of during the first loop
iteration.

I'm also fine with adding data property checks, but that complicates the
implementation even further.

     if (IS_NULL(result)) {
       stringIndex += AdvanceStringIndex(string, stringIndex, unicode);
     } else {