[regexp] Use SameValue in @@search as specced

test/mjsunit/regexp.js

Index: test/mjsunit/regexp.js
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index 4087790d01f0f3a76fe43eac107f492a65a0bab7..fd698967c4e4526b9310632496a1bf77e5e99f38 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -739,3 +739,11 @@ const RegExpPrototypeExec = RegExp.prototype.exec;
 RegExp.prototype.exec = function() { throw new Error(); }
 assertThrows(() => "abc".replace(/./, ""));
 RegExp.prototype.exec = RegExpPrototypeExec;
+
+// Test the code path in RE.proto[@@search] when previousLastIndex is a receiver
+// but can't be converted to a primitive. This exposed a crash in the
+// C++ implementation of @@search.
+
+var re = /./;
+re.lastIndex = { [Symbol.toPrimitive]: 42 };
+() => "abc".search(re);

[Dan Ehrenberg, 2016/11/02 12:03:45]

Does this test actually run anything? Did you mean to have an assertThrows call
here?

[jgruber, 2016/11/07 07:56:18]

Good catch, thanks! This line was originally in an assertThrows, which tested a
specific code path in Object::Equals when lastIndex was not convertible to
primitive. 

However, assertThrows is no longer correct now that we use Object::SameValue
instead, which does not throw in this case.

Will fix in another CL.