[regexp] Add additional asserts to RegExp builtins

src/builtins/builtins-regexp-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp-gen.h"
 
 #include "src/builtins/builtins-constructor-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 51 matching lines @@
   if (is_fastpath) {
     FastStoreLastIndex(regexp, value);
   } else {
     SlowStoreLastIndex(context, regexp, value);
   }
 }
 
 Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     Node* const context, Node* const regexp, Node* const match_info,
     Node* const string) {
+  CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));

[Camillo Bruni, 2017/04/06 10:59:27]

nit: could you use/add IsJSRegexp?

[jgruber, 2017/04/06 14:54:23]

Done and updated all use sites.

+  CSA_ASSERT(this, IsFixedArrayMap(LoadMap(match_info)));
+  CSA_ASSERT(this, IsString(string));
+
   Label named_captures(this), out(this);
 
   Node* const num_indices = SmiUntag(LoadFixedArrayElement(
       match_info, RegExpMatchInfo::kNumberOfCapturesIndex));
   Node* const num_results = SmiTag(WordShr(num_indices, 1));
   Node* const start =
       LoadFixedArrayElement(match_info, RegExpMatchInfo::kFirstCaptureIndex);
   Node* const end = LoadFixedArrayElement(
       match_info, RegExpMatchInfo::kFirstCaptureIndex + 1);
 
@@ skipping 400 matching lines @@
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   if (is_fastpath) {
     CSA_ASSERT(this, IsFastRegExpNoPrototype(context, regexp, LoadMap(regexp)));
   } else {
     ThrowIfNotInstanceType(context, regexp, JS_REGEXP_TYPE,
                            "RegExp.prototype.exec");
   }
 
-  CSA_ASSERT(this, IsStringInstanceType(LoadInstanceType(string)));
+  CSA_ASSERT(this, IsString(string));
   CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
 
   Variable var_result(this, MachineRepresentation::kTagged);
   Label out(this);
 
   // Load lastIndex.
   Variable var_lastindex(this, MachineRepresentation::kTagged);
   {
     Node* const regexp_lastindex = LoadLastIndex(context, regexp, is_fastpath);
     var_lastindex.Bind(regexp_lastindex);
@@ skipping 219 matching lines @@
 
   GotoIfNot(proto_has_initialmap, if_ismodified);
 
   // The smi check is required to omit ToLength(lastIndex) calls with possible
   // user-code execution on the fast path.
   Node* const last_index = FastLoadLastIndex(object);
   Branch(TaggedIsPositiveSmi(last_index), if_isunmodified, if_ismodified);
 }
 
 Node* RegExpBuiltinsAssembler::IsFastRegExp(Node* const context,
+                                            Node* const object) {
+  return IsFastRegExp(context, object, LoadMap(object));
+}
+
+Node* RegExpBuiltinsAssembler::IsFastRegExp(Node* const context,
                                             Node* const object,
                                             Node* const map) {
   Label yup(this), nope(this), out(this);
   Variable var_result(this, MachineRepresentation::kWord32);
 
   BranchIfFastRegExp(context, object, map, &yup, &nope);
 
   Bind(&yup);
   var_result.Bind(Int32Constant(1));
   Goto(&out);
@@ skipping 70 matching lines @@
   Variable var_length(this, MachineType::PointerRepresentation(), int_zero);
   Variable var_flags(this, MachineType::PointerRepresentation());
 
   Node* const is_dotall_enabled = IsDotAllEnabled(isolate);
 
   // First, count the number of characters we will need and check which flags
   // are set.
 
   if (is_fastpath) {
     // Refer to JSRegExp's flag property on the fast-path.
+    CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));

[Camillo Bruni, 2017/04/06 10:59:27]

ditto

[jgruber, 2017/04/06 14:54:23]

Done.

     Node* const flags_smi = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
     Node* const flags_intptr = SmiUntag(flags_smi);
     var_flags.Bind(flags_intptr);
 
 #define CASE_FOR_FLAG(FLAG)                                  \
   do {                                                       \
     Label next(this);                                        \
     GotoIfNot(IsSetWord(flags_intptr, FLAG), &next);         \
     var_length.Bind(IntPtrAdd(var_length.value(), int_one)); \
     Goto(&next);                                             \
@@ skipping 123 matching lines @@
   Bind(&out);
   return var_result.value();
 }
 
 // ES#sec-regexpinitialize
 // Runtime Semantics: RegExpInitialize ( obj, pattern, flags )
 Node* RegExpBuiltinsAssembler::RegExpInitialize(Node* const context,
                                                 Node* const regexp,
                                                 Node* const maybe_pattern,
                                                 Node* const maybe_flags) {
+  CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
+
   // Normalize pattern.
   Node* const pattern =
       Select(IsUndefined(maybe_pattern), [=] { return EmptyStringConstant(); },
              [=] { return ToString(context, maybe_pattern); },
              MachineRepresentation::kTagged);
 
   // Normalize flags.
   Node* const flags =
       Select(IsUndefined(maybe_flags), [=] { return EmptyStringConstant(); },
              [=] { return ToString(context, maybe_flags); },
@@ skipping 547 matching lines @@
     // Return true iff exec matched successfully.
     Node* const result =
         SelectBooleanConstant(WordNotEqual(match_indices, NullConstant()));
     Return(result);
   }
 }
 
 Node* RegExpBuiltinsAssembler::AdvanceStringIndex(Node* const string,
                                                   Node* const index,
                                                   Node* const is_unicode) {
+  CSA_ASSERT(this, IsString(string));
+  // TODO(jgruber): Handle HeapNumber index.
+
   // Default to last_index + 1.
   Node* const index_plus_one = SmiAdd(index, SmiConstant(1));
   Variable var_result(this, MachineRepresentation::kTagged, index_plus_one);
 
   Label if_isunicode(this), out(this);
   Branch(is_unicode, &if_isunicode, &out);
 
   Bind(&if_isunicode);
   {
     Node* const string_length = LoadStringLength(string);
@@ skipping 169 matching lines @@
   Variable var_length_;
   Variable var_capacity_;
 };
 
 }  // namespace
 
 void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
                                                        Node* const regexp,
                                                        Node* const string,
                                                        const bool is_fastpath) {
+  CSA_ASSERT(this, IsString(string));
+  if (is_fastpath) {
+    CSA_ASSERT(this, IsFastRegExp(context, regexp));

[Camillo Bruni, 2017/04/06 10:59:27]

nit: oneline statement would be fine here.
if (...) CSA_ASSERT(...);

[jgruber, 2017/04/06 14:54:23]

Done.

+  }
+
   Node* const null = NullConstant();
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   Node* const is_global =
       FlagGetter(context, regexp, JSRegExp::kGlobal, is_fastpath);
 
   Label if_isglobal(this), if_isnotglobal(this);
   Branch(is_global, &if_isglobal, &if_isnotglobal);
 
@@ skipping 154 matching lines @@
 
   Bind(&fast_path);
   RegExpPrototypeMatchBody(context, receiver, string, true);
 
   Bind(&slow_path);
   RegExpPrototypeMatchBody(context, receiver, string, false);
 }
 
 void RegExpBuiltinsAssembler::RegExpPrototypeSearchBodyFast(
     Node* const context, Node* const regexp, Node* const string) {
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, IsString(string));
+
   // Grab the initial value of last index.
   Node* const previous_last_index = FastLoadLastIndex(regexp);
 
   // Ensure last index is 0.
   FastStoreLastIndex(regexp, SmiConstant(Smi::kZero));
 
   // Call exec.
   Label if_didnotmatch(this);
   Node* const match_indices = RegExpPrototypeExecBodyWithoutResult(
       context, regexp, string, &if_didnotmatch, true);
@@ skipping 12 matching lines @@
   Bind(&if_didnotmatch);
   {
     // Reset last index and return -1.
     FastStoreLastIndex(regexp, previous_last_index);
     Return(SmiConstant(-1));
   }
 }
 
 void RegExpBuiltinsAssembler::RegExpPrototypeSearchBodySlow(
     Node* const context, Node* const regexp, Node* const string) {
+  CSA_ASSERT(this, IsJSReceiver(regexp));
+  CSA_ASSERT(this, IsString(string));
+
   Isolate* const isolate = this->isolate();
 
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   // Grab the initial value of last index.
   Node* const previous_last_index = SlowLoadLastIndex(context, regexp);
 
   // Ensure last index is 0.
   {
     Label next(this);
@@ skipping 74 matching lines @@
   Bind(&slow_path);
   RegExpPrototypeSearchBodySlow(context, receiver, string);
 }
 
 // Generates the fast path for @@split. {regexp} is an unmodified JSRegExp,
 // {string} is a String, and {limit} is a Smi.
 void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
                                                        Node* const regexp,
                                                        Node* const string,
                                                        Node* const limit) {
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, TaggedIsSmi(limit));
+  CSA_ASSERT(this, IsString(string));
+
   Node* const null = NullConstant();
   Node* const smi_zero = SmiConstant(0);
   Node* const int_zero = IntPtrConstant(0);
   Node* const int_limit = SmiUntag(limit);
 
   const ElementsKind kind = FAST_ELEMENTS;
   const ParameterMode mode = CodeStubAssembler::INTPTR_PARAMETERS;
 
   Node* const allocation_site = nullptr;
   Node* const native_context = LoadNativeContext(context);
@@ skipping 60 matching lines @@
                       &var_next_search_from};
   const int vars_count = sizeof(vars) / sizeof(vars[0]);
   Label loop(this, vars_count, vars), push_suffix_and_out(this), out(this);
   Goto(&loop);
 
   Bind(&loop);
   {
     Node* const next_search_from = var_next_search_from.value();
     Node* const last_matched_until = var_last_matched_until.value();
 
+    CSA_ASSERT(this, TaggedIsSmi(next_search_from));
+    CSA_ASSERT(this, TaggedIsSmi(last_matched_until));
+
     // We're done if we've reached the end of the string.
     {
       Label next(this);
       Branch(SmiEqual(next_search_from, string_length), &push_suffix_and_out,
              &next);
       Bind(&next);
     }
 
     // Search for the given {regexp}.
 
@@ skipping 143 matching lines @@
   }
 }
 
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpSplit, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kReceiver);
   Node* const string = Parameter(Descriptor::kString);
   Node* const maybe_limit = Parameter(Descriptor::kLimit);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, IsFastRegExp(context, regexp, LoadMap(regexp)));
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
   CSA_ASSERT(this, IsString(string));
 
   // TODO(jgruber): Even if map checks send us to the fast path, we still need
   // to verify the constructor property and jump to the slow path if it has
   // been changed.
 
   // Convert {maybe_limit} to a uint32, capping at the maximal smi value.
   Variable var_limit(this, MachineRepresentation::kTagged);
   Label if_limitissmimax(this), limit_done(this);
 
@@ skipping 49 matching lines @@
   Bind(&runtime);
   Return(CallRuntime(Runtime::kRegExpSplit, context, receiver, string,
                      maybe_limit));
 }
 
 Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
     Node* context, Node* regexp, Node* string, Node* replace_callable) {
   // The fast path is reached only if {receiver} is a global unmodified
   // JSRegExp instance and {replace_callable} is callable.
 
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, IsCallable(replace_callable));
+  CSA_ASSERT(this, IsString(string));
+
   Isolate* const isolate = this->isolate();
 
   Node* const null = NullConstant();
   Node* const undefined = UndefinedConstant();
   Node* const int_zero = IntPtrConstant(0);
   Node* const int_one = IntPtrConstant(1);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   Node* const native_context = LoadNativeContext(context);
 
@@ skipping 194 matching lines @@
 Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
     Node* context, Node* regexp, Node* string, Node* replace_string) {
   // The fast path is reached only if {receiver} is an unmodified
   // JSRegExp instance, {replace_value} is non-callable, and
   // ToString({replace_value}) does not contain '$', i.e. we're doing a simple
   // string replacement.
 
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, IsString(replace_string));
+  CSA_ASSERT(this, IsString(string));
+
   Label out(this);
   Variable var_result(this, MachineRepresentation::kTagged);
 
   // Load the last match info.
   Node* const native_context = LoadNativeContext(context);
   Node* const last_match_info =
       LoadContextElement(native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
   // Is {regexp} global?
   Label if_isglobal(this), if_isnonglobal(this);
@@ skipping 76 matching lines @@
   return var_result.value();
 }
 
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kReceiver);
   Node* const string = Parameter(Descriptor::kString);
   Node* const replace_value = Parameter(Descriptor::kReplaceValue);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, IsFastRegExp(context, regexp, LoadMap(regexp)));
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
   CSA_ASSERT(this, IsString(string));
 
   Label checkreplacestring(this), if_iscallable(this),
       runtime(this, Label::kDeferred);
 
   // 2. Is {replace_value} callable?
   GotoIf(TaggedIsSmi(replace_value), &checkreplacestring);
   Branch(IsCallableMap(LoadMap(replace_value)), &if_iscallable,
          &checkreplacestring);
 
@@ skipping 87 matching lines @@
 }
 
 // Simple string matching functionality for internal use which does not modify
 // the last match info.
 TF_BUILTIN(RegExpInternalMatch, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kRegExp);
   Node* const string = Parameter(Descriptor::kString);
   Node* const context = Parameter(Descriptor::kContext);
 
   Node* const null = NullConstant();
-  Node* const smi_zero = SmiConstant(Smi::FromInt(0));
+  Node* const smi_zero = SmiConstant(0);
+
+  CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
+  CSA_ASSERT(this, IsString(string));
 
   Node* const native_context = LoadNativeContext(context);
   Node* const internal_match_info = LoadContextElement(
       native_context, Context::REGEXP_INTERNAL_MATCH_INFO_INDEX);
 
   Node* const match_indices =
       IrregexpExec(context, regexp, string, smi_zero, internal_match_info);
 
   Label if_matched(this), if_didnotmatch(this);
   Branch(WordEqual(match_indices, null), &if_didnotmatch, &if_matched);
 
   Bind(&if_didnotmatch);
   Return(null);
 
   Bind(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, regexp, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8