Index: src/regexp/regexp-utils.cc |
diff --git a/src/regexp/regexp-utils.cc b/src/regexp/regexp-utils.cc |
index d40431866a391388b4e8ebfbbbe75e529e6bb2c5..570a348f74a42c1f9029596da676c9ad740ed479 100644 |
--- a/src/regexp/regexp-utils.cc |
+++ b/src/regexp/regexp-utils.cc |
@@ -145,7 +145,14 @@ bool RegExpUtils::IsUnmodifiedRegExp(Isolate* isolate, Handle<Object> obj) { |
if (!proto->IsJSReceiver()) return false; |
Handle<Map> initial_proto_initial_map = isolate->regexp_prototype_map(); |
- return (JSReceiver::cast(proto)->map() == *initial_proto_initial_map); |
+ if (JSReceiver::cast(proto)->map() != *initial_proto_initial_map) { |
+ return false; |
+ } |
+ |
+ // The smi check is required to omit ToLength(lastIndex) calls with possible |
+ // user-code execution on the fast path. |
+ Object* last_index = JSRegExp::cast(recv)->LastIndex(); |
+ return last_index->IsSmi() && Smi::cast(last_index)->value() >= 0; |
} |
int RegExpUtils::AdvanceStringIndex(Isolate* isolate, Handle<String> string, |