[regexp] Port RegExp.prototype[@@replace]

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/base/ieee754.h"
 #include "src/code-stubs.h"
@@ skipping 1667 matching lines @@
         InstallFunction(global, "RegExp", JS_REGEXP_TYPE, JSRegExp::kSize,
                         prototype, Builtins::kRegExpConstructor);
     InstallWithIntrinsicDefaultProto(isolate, regexp_fun,
                                      Context::REGEXP_FUNCTION_INDEX);
 
     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate);
     shared->SetConstructStub(*isolate->builtins()->RegExpConstructor());
     shared->set_instance_class_name(isolate->heap()->RegExp_string());
     shared->DontAdaptArguments();
     shared->set_length(2);
-
     {
       // RegExp.prototype setup.
 
       // Install the "constructor" property on the {prototype}.
       JSObject::AddProperty(prototype, factory->constructor_string(),
                             regexp_fun, DONT_ENUM);
 
       {
         Handle<JSFunction> fun = SimpleInstallFunction(
             prototype, "exec", Builtins::kRegExpPrototypeExec, 1, true,
@@ skipping 27 matching lines @@
 
       {
         Handle<JSFunction> fun = SimpleCreateFunction(
             isolate, factory->InternalizeUtf8String("[Symbol.match]"),
             Builtins::kRegExpPrototypeMatch, 1, false);
         InstallFunction(prototype, fun, factory->match_symbol(), DONT_ENUM);
       }
 
       {
         Handle<JSFunction> fun = SimpleCreateFunction(
+            isolate, factory->InternalizeUtf8String("[Symbol.replace]"),
+            Builtins::kRegExpPrototypeReplace, 2, true);
+        InstallFunction(prototype, fun, factory->replace_symbol(), DONT_ENUM);
+      }
+
+      {
+        Handle<JSFunction> fun = SimpleCreateFunction(
             isolate, factory->InternalizeUtf8String("[Symbol.search]"),
             Builtins::kRegExpPrototypeSearch, 1, false);
         InstallFunction(prototype, fun, factory->search_symbol(), DONT_ENUM);
       }
 
       {
         Handle<JSFunction> fun = SimpleCreateFunction(
             isolate, factory->InternalizeUtf8String("[Symbol.split]"),
             Builtins::kRegExpPrototypeSplit, 2, false);
         InstallFunction(prototype, fun, factory->split_symbol(), DONT_ENUM);
       }
+
+      // Store the initial RegExp.prototype map. This is used in fast-path
+      // checks. Do not alter the prototype after this point.
+      isolate->native_context()->set_regexp_prototype_map(prototype->map());
     }
 
     {
       // RegExp getters and setters.
 
       // TODO(jgruber): This should really be DONT_ENUM | DONT_DELETE.
       // However, that currently breaks layout test expectations. Note that
       // Firefox sets a couple of these as enumerable.
       // On the other hand, installing attributes as DONT_ENUM matches the draft
       // specification at
@@ skipping 2602 matching lines @@
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 }  // namespace internal
 }  // namespace v8