[regexp] Sticky handling in fast slow path

src/builtins/builtins-regexp.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp.h"
 
 #include "src/builtins/builtins-constructor.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 220 matching lines @@
     ThrowIfNotInstanceType(context, regexp, JS_REGEXP_TYPE,
                            "RegExp.prototype.exec");
   }
 
   CSA_ASSERT(this, IsStringInstanceType(LoadInstanceType(string)));
   CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
 
   Variable var_result(this, MachineRepresentation::kTagged);
   Label out(this);
 
-  Node* const native_context = LoadNativeContext(context);
-  Node* const string_length = LoadStringLength(string);
-
   // Load lastIndex.
   Variable var_lastindex(this, MachineRepresentation::kTagged);
   {
     Node* const regexp_lastindex = LoadLastIndex(context, regexp, is_fastpath);
     var_lastindex.Bind(regexp_lastindex);
 
     // Omit ToLength if lastindex is a non-negative smi.
     Label call_tolength(this, Label::kDeferred), next(this);
     Branch(TaggedIsPositiveSmi(regexp_lastindex), &next, &call_tolength);
 
@@ skipping 21 matching lines @@
   {
     Label if_doupdate(this), if_dontupdate(this);
     Branch(should_update_last_index, &if_doupdate, &if_dontupdate);
 
     Bind(&if_doupdate);
     {
       Node* const lastindex = var_lastindex.value();
 
       Label if_isoob(this, Label::kDeferred);
       GotoUnless(TaggedIsSmi(lastindex), &if_isoob);
+      Node* const string_length = LoadStringLength(string);

[jgruber, 2017/02/13 12:15:38]

This and below are drive-by cleanups that push loads to before use sites.

       GotoUnless(SmiLessThanOrEqual(lastindex, string_length), &if_isoob);
       Goto(&run_exec);
 
       Bind(&if_isoob);
       {
         StoreLastIndex(context, regexp, smi_zero, is_fastpath);
         var_result.Bind(null);
         Goto(if_didnotmatch);
       }
     }
 
     Bind(&if_dontupdate);
     {
       var_lastindex.Bind(smi_zero);
       Goto(&run_exec);
     }
   }
 
   Node* match_indices;
   Label successful_match(this);
   Bind(&run_exec);
   {
     // Get last match info from the context.
+    Node* const native_context = LoadNativeContext(context);
     Node* const last_match_info = LoadContextElement(
         native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
     // Call the exec stub.
     Callable exec_callable = CodeFactory::RegExpExec(isolate);
     match_indices = CallStub(exec_callable, context, regexp, string,
                              var_lastindex.value(), last_match_info);
     var_result.Bind(match_indices);
 
     // {match_indices} is either null or the RegExpMatchInfo array.
@@ skipping 2012 matching lines @@
   return var_result.value();
 }
 
 Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
     Node* context, Node* regexp, Node* string, Node* replace_string) {
   // The fast path is reached only if {receiver} is an unmodified
   // JSRegExp instance, {replace_value} is non-callable, and
   // ToString({replace_value}) does not contain '$', i.e. we're doing a simple
   // string replacement.
 
-  Isolate* const isolate = this->isolate();
-
-  Node* const null = NullConstant();
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   Label out(this);
   Variable var_result(this, MachineRepresentation::kTagged);
 
   // Load the last match info.
   Node* const native_context = LoadNativeContext(context);
   Node* const last_match_info =
       LoadContextElement(native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
@@ skipping 12 matching lines @@
     Node* const result =
         CallRuntime(Runtime::kStringReplaceGlobalRegExpWithString, context,
                     string, regexp, replace_string, last_match_info);
     var_result.Bind(result);
     Goto(&out);
   }
 
   Bind(&if_isnonglobal);
   {
     // Run exec, then manually construct the resulting string.
-    Callable exec_callable = CodeFactory::RegExpExec(isolate);
-    Node* const match_indices = CallStub(exec_callable, context, regexp, string,
-                                         smi_zero, last_match_info);
+    Label if_didnotmatch(this);
+    Node* const match_indices = RegExpPrototypeExecBodyWithoutResult(

[jgruber, 2017/02/13 12:15:38]

Replaced RE.p.exec emulation by inlined version of the actual exec code to avoid
issues around lastIndex.

+        context, regexp, string, &if_didnotmatch, true);
 
-    Label if_matched(this), if_didnotmatch(this);
-    Branch(WordEqual(match_indices, null), &if_didnotmatch, &if_matched);
-
-    Bind(&if_didnotmatch);
-    {
-      FastStoreLastIndex(regexp, smi_zero);
-      var_result.Bind(string);
-      Goto(&out);
-    }
-
-    Bind(&if_matched);
+    // Successful match.
     {
       Node* const subject_start = smi_zero;
       Node* const match_start = LoadFixedArrayElement(
           match_indices, RegExpMatchInfo::kFirstCaptureIndex);
       Node* const match_end = LoadFixedArrayElement(
           match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1);
       Node* const subject_end = LoadStringLength(string);
 
       Label if_replaceisempty(this), if_replaceisnotempty(this);
       Node* const replace_length = LoadStringLength(replace_string);
@@ skipping 23 matching lines @@
         Node* const third_part =
             SubString(context, string, match_end, subject_end);
 
         Node* result = StringAdd(context, first_part, second_part);
         result = StringAdd(context, result, third_part);
 
         var_result.Bind(result);
         Goto(&out);
       }
     }
+
+    Bind(&if_didnotmatch);
+    {
+      var_result.Bind(string);
+      Goto(&out);
+    }
   }
 
   Bind(&out);
   return var_result.value();
 }
 
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler) {
   typedef RegExpReplaceDescriptor Descriptor;
 
@@ skipping 56 matching lines @@
 }
 
 // ES#sec-regexp.prototype-@@replace
 // RegExp.prototype [ @@replace ] ( string, replaceValue )
 TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const replace_value = Parameter(2);
   Node* const context = Parameter(5);
 
+  // RegExpPrototypeReplace is a bit of a beast - a summary of dispatch logic:
+  //
+  // if (!IsFastRegExp(receiver)) CallRuntime(RegExpReplace)
+  // if (IsCallable(replace)) {
+  //   if (IsGlobal(receiver)) {
+  //     // Called 'fast-path' but contains several runtime calls.
+  //     ReplaceGlobalCallableFastPath()
+  //   } else {
+  //     CallRuntime(StringReplaceNonGlobalRegExpWithFunction)
+  //   }
+  // } else {
+  //   if (replace.contains("$")) {
+  //     CallRuntime(RegExpReplace)
+  //   } else {
+  //     ReplaceSimpleStringFastPath()  // Bails to runtime for global regexps.
+  //   }
+  // }
+
   // Ensure {maybe_receiver} is a JSReceiver.
   Node* const map = ThrowIfNotJSReceiver(
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
       "RegExp.prototype.@@replace");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Callable tostring_callable = CodeFactory::ToString(isolate());
   Node* const string = CallStub(tostring_callable, context, maybe_string);
 
@@ skipping 37 matching lines @@
   Bind(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, regexp, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8