[regexp] Ensure there are no shape changes on the fast path

src/regexp/regexp-utils.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/regexp/regexp-utils.h"
 
 #include "src/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
 #include "src/regexp/jsregexp.h"
@@ skipping 127 matching lines @@
 
   // Check the receiver's map.
   Handle<JSFunction> regexp_function = isolate->regexp_function();
   if (recv->map() != regexp_function->initial_map()) return false;
 
   // Check the receiver's prototype's map.
   Object* proto = recv->map()->prototype();
   if (!proto->IsJSReceiver()) return false;
 
   Handle<Map> initial_proto_initial_map = isolate->regexp_prototype_map();
-  return (JSReceiver::cast(proto)->map() == *initial_proto_initial_map);
+  if (JSReceiver::cast(proto)->map() != *initial_proto_initial_map) {
+    return false;
+  }
+
+  // The smi check is required to omit ToLength(lastIndex) calls with possible
+  // user-code execution on the fast path.
+  Object* last_index = JSRegExp::cast(recv)->LastIndex();
+  return last_index->IsSmi() && Smi::cast(last_index)->value() >= 0;
 }
 
 int RegExpUtils::AdvanceStringIndex(Isolate* isolate, Handle<String> string,
                                     int index, bool unicode) {
   if (unicode && index < string->length()) {
     const uint16_t first = string->Get(index);
     if (first >= 0xD800 && first <= 0xDBFF && string->length() > index + 1) {
       const uint16_t second = string->Get(index + 1);
       if (second >= 0xDC00 && second <= 0xDFFF) {
         return index + 2;
@@ skipping 17 matching lines @@
                              Object::ToLength(isolate, last_index_obj), Object);
   const int last_index = PositiveNumberToUint32(*last_index_obj);
   const int new_last_index =
       AdvanceStringIndex(isolate, string, last_index, unicode);
 
   return SetLastIndex(isolate, regexp, new_last_index);
 }
 
 }  // namespace internal
 }  // namespace v8