[regexp] Only access result.groups if named captures are enabled

src/runtime/runtime-regexp.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include <functional>
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
@@ skipping 1098 matching lines @@
 
   bool has_named_captures_;
   Handle<JSReceiver> groups_obj_;
 };
 
 // Create the groups object (see also the RegExp result creation in
 // RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo).
 Handle<JSObject> ConstructNamedCaptureGroupsObject(
     Isolate* isolate, Handle<FixedArray> capture_map,
     std::function<Object*(int)> f_get_capture) {
+  DCHECK(FLAG_harmony_regexp_named_captures);
   Handle<JSObject> groups = isolate->factory()->NewJSObjectWithNullProto();
 
   const int capture_count = capture_map->length() >> 1;
   for (int i = 0; i < capture_count; i++) {
     const int name_ix = i * 2;
     const int index_ix = i * 2 + 1;
 
     Handle<String> capture_name(String::cast(capture_map->get(name_ix)));
     const int capture_ix = Smi::cast(capture_map->get(index_ix))->value();
     DCHECK(1 <= capture_ix && capture_ix <= capture_count);
@@ skipping 92 matching lines @@
         first = false;
       }
 
       if (has_capture) {
         // Arguments array to replace function is match, captures, index and
         // subject, i.e., 3 + capture count in total. If the RegExp contains
         // named captures, they are also passed as the last argument.
 
         Handle<Object> maybe_capture_map(regexp->CaptureNameMap(), isolate);
         const bool has_named_captures = maybe_capture_map->IsFixedArray();
+        DCHECK_IMPLIES(has_named_captures, FLAG_harmony_regexp_named_captures);
 
         const int argc =
             has_named_captures ? 4 + capture_count : 3 + capture_count;
 
         Handle<FixedArray> elements = isolate->factory()->NewFixedArray(argc);
         int cursor = 0;
 
         elements->set(cursor++, *match);
         for (int i = 1; i <= capture_count; i++) {
           int start = current_match[i * 2];
           if (start >= 0) {
             int end = current_match[i * 2 + 1];
             DCHECK(start <= end);
             Handle<String> substring =
                 isolate->factory()->NewSubString(subject, start, end);
             elements->set(cursor++, *substring);
           } else {
             DCHECK(current_match[i * 2 + 1] < 0);
             elements->set(cursor++, isolate->heap()->undefined_value());
           }
         }
 
         elements->set(cursor++, Smi::FromInt(match_start));
         elements->set(cursor++, *subject);
 
         if (has_named_captures) {
-          DCHECK(FLAG_harmony_regexp_named_captures);
           Handle<FixedArray> capture_map =
               Handle<FixedArray>::cast(maybe_capture_map);
           Handle<JSObject> groups = ConstructNamedCaptureGroupsObject(
               isolate, capture_map, [=](int ix) { return elements->get(ix); });
           elements->set(cursor++, *groups);
         }
 
         DCHECK_EQ(cursor, argc);
         builder.Add(*isolate->factory()->NewJSArrayWithElements(elements));
       } else {
@@ skipping 224 matching lines @@
   const int m = match_indices->NumberOfCaptureRegisters() / 2;
 
   bool has_named_captures = false;
   Handle<FixedArray> capture_map;
   if (m > 1) {
     // The existence of capture groups implies IRREGEXP kind.
     DCHECK_EQ(regexp->TypeTag(), JSRegExp::IRREGEXP);
 
     Object* maybe_capture_map = regexp->CaptureNameMap();
     if (maybe_capture_map->IsFixedArray()) {
-      DCHECK(FLAG_harmony_regexp_named_captures);
       has_named_captures = true;
       capture_map = handle(FixedArray::cast(maybe_capture_map));
     }
   }
 
+  DCHECK_IMPLIES(has_named_captures, FLAG_harmony_regexp_named_captures);
   const int argc = has_named_captures ? m + 3 : m + 2;
   ScopedVector<Handle<Object>> argv(argc);
 
   int cursor = 0;
   for (int j = 0; j < m; j++) {
     bool ok;
     Handle<String> capture =
         RegExpUtils::GenericCaptureGetter(isolate, match_indices, j, &ok);
     if (ok) {
       argv[cursor++] = capture;
@@ skipping 328 matching lines @@
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, capture, Object::GetElement(isolate, result, n));
 
       if (!capture->IsUndefined(isolate)) {
         ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, capture,
                                            Object::ToString(isolate, capture));
       }
       captures.push_back(capture);
     }
 
-    Handle<Object> groups_obj;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, groups_obj,
-        Object::GetProperty(result, factory->groups_string()));
+    Handle<Object> groups_obj = isolate->factory()->undefined_value();
+    if (FLAG_harmony_regexp_named_captures) {
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, groups_obj,
+          Object::GetProperty(result, factory->groups_string()));
+    }
 
     const bool has_named_captures = !groups_obj->IsUndefined(isolate);
+    DCHECK_IMPLIES(has_named_captures, FLAG_harmony_regexp_named_captures);
 
     Handle<String> replacement;
     if (functional_replace) {
       const int argc =
           has_named_captures ? captures_length + 3 : captures_length + 2;
       ScopedVector<Handle<Object>> argv(argc);
 
       int cursor = 0;
       for (int j = 0; j < captures_length; j++) {
         argv[cursor++] = captures[j];
@@ skipping 66 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_IsRegExp) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(Object, obj, 0);
   return isolate->heap()->ToBoolean(obj->IsJSRegExp());
 }
 
 }  // namespace internal
 }  // namespace v8