[regexp] Add additional asserts to RegExp builtins

src/builtins/builtins-regexp-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp-gen.h"
 
 #include "src/builtins/builtins-constructor-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 51 matching lines @@
   if (is_fastpath) {
     FastStoreLastIndex(regexp, value);
   } else {
     SlowStoreLastIndex(context, regexp, value);
   }
 }
 
 Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     Node* const context, Node* const regexp, Node* const match_info,
     Node* const string) {
+  CSA_ASSERT(this, IsFixedArrayMap(LoadMap(match_info)));
+  CSA_ASSERT(this, IsJSRegExp(regexp));
+  CSA_ASSERT(this, IsString(string));
+
   Label named_captures(this), out(this);
 
   Node* const num_indices = SmiUntag(LoadFixedArrayElement(
       match_info, RegExpMatchInfo::kNumberOfCapturesIndex));
   Node* const num_results = SmiTag(WordShr(num_indices, 1));
   Node* const start =
       LoadFixedArrayElement(match_info, RegExpMatchInfo::kFirstCaptureIndex);
   Node* const end = LoadFixedArrayElement(
       match_info, RegExpMatchInfo::kFirstCaptureIndex + 1);
 
@@ skipping 45 matching lines @@
     var_to_cursor.Bind(IntPtrAdd(to_cursor, IntPtrConstant(1)));
     Branch(UintPtrLessThan(var_from_cursor.value(), limit), &loop,
            &named_captures);
   }
 
   BIND(&named_captures);
   {
     // We reach this point only if captures exist, implying that this is an
     // IRREGEXP JSRegExp.
 
-    CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
+    CSA_ASSERT(this, IsJSRegExp(regexp));
     CSA_ASSERT(this, SmiGreaterThan(num_results, SmiConstant(1)));
 
     // Preparations for named capture properties. Exit early if the result does
     // not have any named captures to minimize performance impact.
 
     Node* const data = LoadObjectField(regexp, JSRegExp::kDataOffset);
     CSA_ASSERT(this, SmiEqual(LoadFixedArrayElement(data, JSRegExp::kTagIndex),
                               SmiConstant(JSRegExp::IRREGEXP)));
 
     // The names fixed array associates names at even indices with a capture
@@ skipping 86 matching lines @@
                                             Node* const last_index,
                                             Node* const match_info) {
 // Just jump directly to runtime if native RegExp is not selected at compile
 // time or if regexp entry in generated code is turned off runtime switch or
 // at compilation.
 #ifdef V8_INTERPRETED_REGEXP
   return CallRuntime(Runtime::kRegExpExec, context, regexp, string, last_index,
                      match_info);
 #else   // V8_INTERPRETED_REGEXP
   CSA_ASSERT(this, TaggedIsNotSmi(regexp));
-  CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
+  CSA_ASSERT(this, IsJSRegExp(regexp));
 
   CSA_ASSERT(this, TaggedIsNotSmi(string));
   CSA_ASSERT(this, IsString(string));
 
   CSA_ASSERT(this, IsHeapNumberMap(LoadReceiverMap(last_index)));
   CSA_ASSERT(this, IsFixedArrayMap(LoadReceiverMap(match_info)));
 
   Node* const int_zero = IntPtrConstant(0);
 
   ToDirectStringAssembler to_direct(state(), string);
@@ skipping 227 matching lines @@
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   if (is_fastpath) {
     CSA_ASSERT(this, IsFastRegExpNoPrototype(context, regexp, LoadMap(regexp)));
   } else {
     ThrowIfNotInstanceType(context, regexp, JS_REGEXP_TYPE,
                            "RegExp.prototype.exec");
   }
 
-  CSA_ASSERT(this, IsStringInstanceType(LoadInstanceType(string)));
-  CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
+  CSA_ASSERT(this, IsString(string));
+  CSA_ASSERT(this, IsJSRegExp(regexp));
 
   Variable var_result(this, MachineRepresentation::kTagged);
   Label out(this);
 
   // Load lastIndex.
   Variable var_lastindex(this, MachineRepresentation::kTagged);
   {
     Node* const regexp_lastindex = LoadLastIndex(context, regexp, is_fastpath);
     var_lastindex.Bind(regexp_lastindex);
 
@@ skipping 218 matching lines @@
 
   GotoIfNot(proto_has_initialmap, if_ismodified);
 
   // The smi check is required to omit ToLength(lastIndex) calls with possible
   // user-code execution on the fast path.
   Node* const last_index = FastLoadLastIndex(object);
   Branch(TaggedIsPositiveSmi(last_index), if_isunmodified, if_ismodified);
 }
 
 Node* RegExpBuiltinsAssembler::IsFastRegExp(Node* const context,
+                                            Node* const object) {
+  return IsFastRegExp(context, object, LoadMap(object));
+}
+
+Node* RegExpBuiltinsAssembler::IsFastRegExp(Node* const context,
                                             Node* const object,
                                             Node* const map) {
   Label yup(this), nope(this), out(this);
   Variable var_result(this, MachineRepresentation::kWord32);
 
   BranchIfFastRegExp(context, object, map, &yup, &nope);
 
   BIND(&yup);
   var_result.Bind(Int32Constant(1));
   Goto(&out);
@@ skipping 70 matching lines @@
   Variable var_length(this, MachineType::PointerRepresentation(), int_zero);
   Variable var_flags(this, MachineType::PointerRepresentation());
 
   Node* const is_dotall_enabled = IsDotAllEnabled(isolate);
 
   // First, count the number of characters we will need and check which flags
   // are set.
 
   if (is_fastpath) {
     // Refer to JSRegExp's flag property on the fast-path.
+    CSA_ASSERT(this, IsJSRegExp(regexp));
     Node* const flags_smi = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
     Node* const flags_intptr = SmiUntag(flags_smi);
     var_flags.Bind(flags_intptr);
 
 #define CASE_FOR_FLAG(FLAG)                                  \
   do {                                                       \
     Label next(this);                                        \
     GotoIfNot(IsSetWord(flags_intptr, FLAG), &next);         \
     var_length.Bind(IntPtrAdd(var_length.value(), int_one)); \
     Goto(&next);                                             \
@@ skipping 103 matching lines @@
 
   // Check @@match.
   {
     Node* const value =
         GetProperty(context, receiver, isolate()->factory()->match_symbol());
 
     Label match_isundefined(this), match_isnotundefined(this);
     Branch(IsUndefined(value), &match_isundefined, &match_isnotundefined);
 
     BIND(&match_isundefined);
-    Branch(HasInstanceType(receiver, JS_REGEXP_TYPE), &if_isregexp, &out);
+    Branch(IsJSRegExp(receiver), &if_isregexp, &out);
 
     BIND(&match_isnotundefined);
     BranchIfToBooleanIsTrue(value, &if_isregexp, &out);
   }
 
   BIND(&if_isregexp);
   var_result.Bind(Int32Constant(1));
   Goto(&out);
 
   BIND(&out);
   return var_result.value();
 }
 
 // ES#sec-regexpinitialize
 // Runtime Semantics: RegExpInitialize ( obj, pattern, flags )
 Node* RegExpBuiltinsAssembler::RegExpInitialize(Node* const context,
                                                 Node* const regexp,
                                                 Node* const maybe_pattern,
                                                 Node* const maybe_flags) {
+  CSA_ASSERT(this, IsJSRegExp(regexp));
+
   // Normalize pattern.
   Node* const pattern =
       Select(IsUndefined(maybe_pattern), [=] { return EmptyStringConstant(); },
              [=] { return ToString(context, maybe_pattern); },
              MachineRepresentation::kTagged);
 
   // Normalize flags.
   Node* const flags =
       Select(IsUndefined(maybe_flags), [=] { return EmptyStringConstant(); },
              [=] { return ToString(context, maybe_flags); },
@@ skipping 62 matching lines @@
     Return(pattern);
 
     BIND(&next);
   }
 
   {
     Label next(this), if_patternisfastregexp(this),
         if_patternisslowregexp(this);
     GotoIf(TaggedIsSmi(pattern), &next);
 
-    GotoIf(HasInstanceType(pattern, JS_REGEXP_TYPE), &if_patternisfastregexp);
+    GotoIf(IsJSRegExp(pattern), &if_patternisfastregexp);
 
     Branch(pattern_is_regexp, &if_patternisslowregexp, &next);
 
     BIND(&if_patternisfastregexp);
     {
       Node* const source = LoadObjectField(pattern, JSRegExp::kSourceOffset);
       var_pattern.Bind(source);
 
       {
         Label inner_next(this);
@@ skipping 83 matching lines @@
   Node* const receiver = maybe_receiver;
 
   Variable var_flags(this, MachineRepresentation::kTagged, maybe_flags);
   Variable var_pattern(this, MachineRepresentation::kTagged, maybe_pattern);
 
   // Handle a JSRegExp pattern.
   {
     Label next(this);
 
     GotoIf(TaggedIsSmi(maybe_pattern), &next);
-    GotoIfNot(HasInstanceType(maybe_pattern, JS_REGEXP_TYPE), &next);
+    GotoIfNot(IsJSRegExp(maybe_pattern), &next);
 
     Node* const pattern = maybe_pattern;
 
     // {maybe_flags} must be undefined in this case, otherwise throw.
     {
       Label next(this);
       GotoIf(IsUndefined(maybe_flags), &next);
 
       Node* const message_id = SmiConstant(MessageTemplate::kRegExpFlags);
       TailCallRuntime(Runtime::kThrowTypeError, context, message_id);
@@ skipping 19 matching lines @@
 // ES6 21.2.5.10.
 // ES #sec-get-regexp.prototype.source
 TF_BUILTIN(RegExpPrototypeSourceGetter, RegExpBuiltinsAssembler) {
   Node* const receiver = Parameter(Descriptor::kReceiver);
   Node* const context = Parameter(Descriptor::kContext);
 
   // Check whether we have an unmodified regexp instance.
   Label if_isjsregexp(this), if_isnotjsregexp(this, Label::kDeferred);
 
   GotoIf(TaggedIsSmi(receiver), &if_isnotjsregexp);
-  Branch(HasInstanceType(receiver, JS_REGEXP_TYPE), &if_isjsregexp,
-         &if_isnotjsregexp);
+  Branch(IsJSRegExp(receiver), &if_isjsregexp, &if_isnotjsregexp);
 
   BIND(&if_isjsregexp);
   {
     Node* const source = LoadObjectField(receiver, JSRegExp::kSourceOffset);
     Return(source);
   }
 
   BIND(&if_isnotjsregexp);
   {
     Isolate* isolate = this->isolate();
@@ skipping 108 matching lines @@
 void RegExpBuiltinsAssembler::FlagGetter(Node* context, Node* receiver,
                                          JSRegExp::Flag flag, int counter,
                                          const char* method_name) {
   Isolate* isolate = this->isolate();
 
   // Check whether we have an unmodified regexp instance.
   Label if_isunmodifiedjsregexp(this),
       if_isnotunmodifiedjsregexp(this, Label::kDeferred);
 
   GotoIf(TaggedIsSmi(receiver), &if_isnotunmodifiedjsregexp);
-
-  Node* const receiver_map = LoadMap(receiver);
-  Node* const instance_type = LoadMapInstanceType(receiver_map);
-
-  Branch(Word32Equal(instance_type, Int32Constant(JS_REGEXP_TYPE)),
-         &if_isunmodifiedjsregexp, &if_isnotunmodifiedjsregexp);
+  Branch(IsJSRegExp(receiver), &if_isunmodifiedjsregexp,
+         &if_isnotunmodifiedjsregexp);
 
   BIND(&if_isunmodifiedjsregexp);
   {
     // Refer to JSRegExp's flag property on the fast-path.
     Node* const is_flag_set = FastFlagGetter(receiver, flag);
     Return(SelectBooleanConstant(is_flag_set));
   }
 
   BIND(&if_isnotunmodifiedjsregexp);
   {
@@ skipping 185 matching lines @@
     // Return true iff exec matched successfully.
     Node* const result =
         SelectBooleanConstant(WordNotEqual(match_indices, NullConstant()));
     Return(result);
   }
 }
 
 Node* RegExpBuiltinsAssembler::AdvanceStringIndex(Node* const string,
                                                   Node* const index,
                                                   Node* const is_unicode) {
+  CSA_ASSERT(this, IsString(string));
+  // TODO(jgruber): Handle HeapNumber index.
+
   // Default to last_index + 1.
   Node* const index_plus_one = SmiAdd(index, SmiConstant(1));
   Variable var_result(this, MachineRepresentation::kTagged, index_plus_one);
 
   Label if_isunicode(this), out(this);
   Branch(is_unicode, &if_isunicode, &out);
 
   BIND(&if_isunicode);
   {
     Node* const string_length = LoadStringLength(string);
@@ skipping 169 matching lines @@
   Variable var_length_;
   Variable var_capacity_;
 };
 
 }  // namespace
 
 void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
                                                        Node* const regexp,
                                                        Node* const string,
                                                        const bool is_fastpath) {
+  CSA_ASSERT(this, IsString(string));
+  if (is_fastpath) CSA_ASSERT(this, IsFastRegExp(context, regexp));
+
   Node* const null = NullConstant();
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   Node* const is_global =
       FlagGetter(context, regexp, JSRegExp::kGlobal, is_fastpath);
 
   Label if_isglobal(this), if_isnotglobal(this);
   Branch(is_global, &if_isglobal, &if_isnotglobal);
 
@@ skipping 154 matching lines @@
 
   BIND(&fast_path);
   RegExpPrototypeMatchBody(context, receiver, string, true);
 
   BIND(&slow_path);
   RegExpPrototypeMatchBody(context, receiver, string, false);
 }
 
 void RegExpBuiltinsAssembler::RegExpPrototypeSearchBodyFast(
     Node* const context, Node* const regexp, Node* const string) {
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, IsString(string));
+
   // Grab the initial value of last index.
   Node* const previous_last_index = FastLoadLastIndex(regexp);
 
   // Ensure last index is 0.
   FastStoreLastIndex(regexp, SmiConstant(Smi::kZero));
 
   // Call exec.
   Label if_didnotmatch(this);
   Node* const match_indices = RegExpPrototypeExecBodyWithoutResult(
       context, regexp, string, &if_didnotmatch, true);
@@ skipping 12 matching lines @@
   BIND(&if_didnotmatch);
   {
     // Reset last index and return -1.
     FastStoreLastIndex(regexp, previous_last_index);
     Return(SmiConstant(-1));
   }
 }
 
 void RegExpBuiltinsAssembler::RegExpPrototypeSearchBodySlow(
     Node* const context, Node* const regexp, Node* const string) {
+  CSA_ASSERT(this, IsJSReceiver(regexp));
+  CSA_ASSERT(this, IsString(string));
+
   Isolate* const isolate = this->isolate();
 
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   // Grab the initial value of last index.
   Node* const previous_last_index = SlowLoadLastIndex(context, regexp);
 
   // Ensure last index is 0.
   {
     Label next(this);
@@ skipping 74 matching lines @@
   BIND(&slow_path);
   RegExpPrototypeSearchBodySlow(context, receiver, string);
 }
 
 // Generates the fast path for @@split. {regexp} is an unmodified JSRegExp,
 // {string} is a String, and {limit} is a Smi.
 void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
                                                        Node* const regexp,
                                                        Node* const string,
                                                        Node* const limit) {
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, TaggedIsSmi(limit));
+  CSA_ASSERT(this, IsString(string));
+
   Node* const null = NullConstant();
   Node* const smi_zero = SmiConstant(0);
   Node* const int_zero = IntPtrConstant(0);
   Node* const int_limit = SmiUntag(limit);
 
   const ElementsKind kind = FAST_ELEMENTS;
   const ParameterMode mode = CodeStubAssembler::INTPTR_PARAMETERS;
 
   Node* const allocation_site = nullptr;
   Node* const native_context = LoadNativeContext(context);
@@ skipping 60 matching lines @@
                       &var_next_search_from};
   const int vars_count = sizeof(vars) / sizeof(vars[0]);
   Label loop(this, vars_count, vars), push_suffix_and_out(this), out(this);
   Goto(&loop);
 
   BIND(&loop);
   {
     Node* const next_search_from = var_next_search_from.value();
     Node* const last_matched_until = var_last_matched_until.value();
 
+    CSA_ASSERT(this, TaggedIsSmi(next_search_from));
+    CSA_ASSERT(this, TaggedIsSmi(last_matched_until));
+
     // We're done if we've reached the end of the string.
     {
       Label next(this);
       Branch(SmiEqual(next_search_from, string_length), &push_suffix_and_out,
              &next);
       BIND(&next);
     }
 
     // Search for the given {regexp}.
 
@@ skipping 143 matching lines @@
   }
 }
 
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpSplit, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kReceiver);
   Node* const string = Parameter(Descriptor::kString);
   Node* const maybe_limit = Parameter(Descriptor::kLimit);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, IsFastRegExp(context, regexp, LoadMap(regexp)));
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
   CSA_ASSERT(this, IsString(string));
 
   // TODO(jgruber): Even if map checks send us to the fast path, we still need
   // to verify the constructor property and jump to the slow path if it has
   // been changed.
 
   // Convert {maybe_limit} to a uint32, capping at the maximal smi value.
   Variable var_limit(this, MachineRepresentation::kTagged);
   Label if_limitissmimax(this), limit_done(this);
 
@@ skipping 49 matching lines @@
   BIND(&runtime);
   Return(CallRuntime(Runtime::kRegExpSplit, context, receiver, string,
                      maybe_limit));
 }
 
 Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
     Node* context, Node* regexp, Node* string, Node* replace_callable) {
   // The fast path is reached only if {receiver} is a global unmodified
   // JSRegExp instance and {replace_callable} is callable.
 
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, IsCallable(replace_callable));
+  CSA_ASSERT(this, IsString(string));
+
   Isolate* const isolate = this->isolate();
 
   Node* const null = NullConstant();
   Node* const undefined = UndefinedConstant();
   Node* const int_zero = IntPtrConstant(0);
   Node* const int_one = IntPtrConstant(1);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
   Node* const native_context = LoadNativeContext(context);
 
@@ skipping 194 matching lines @@
 Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
     Node* context, Node* regexp, Node* string, Node* replace_string) {
   // The fast path is reached only if {receiver} is an unmodified
   // JSRegExp instance, {replace_value} is non-callable, and
   // ToString({replace_value}) does not contain '$', i.e. we're doing a simple
   // string replacement.
 
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(Smi::kZero);
 
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+  CSA_ASSERT(this, IsString(replace_string));
+  CSA_ASSERT(this, IsString(string));
+
   Label out(this);
   Variable var_result(this, MachineRepresentation::kTagged);
 
   // Load the last match info.
   Node* const native_context = LoadNativeContext(context);
   Node* const last_match_info =
       LoadContextElement(native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
   // Is {regexp} global?
   Label if_isglobal(this), if_isnonglobal(this);
@@ skipping 76 matching lines @@
   return var_result.value();
 }
 
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kReceiver);
   Node* const string = Parameter(Descriptor::kString);
   Node* const replace_value = Parameter(Descriptor::kReplaceValue);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, IsFastRegExp(context, regexp, LoadMap(regexp)));
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
   CSA_ASSERT(this, IsString(string));
 
   Label checkreplacestring(this), if_iscallable(this),
       runtime(this, Label::kDeferred);
 
   // 2. Is {replace_value} callable?
   GotoIf(TaggedIsSmi(replace_value), &checkreplacestring);
   Branch(IsCallableMap(LoadMap(replace_value)), &if_iscallable,
          &checkreplacestring);
 
@@ skipping 87 matching lines @@
 }
 
 // Simple string matching functionality for internal use which does not modify
 // the last match info.
 TF_BUILTIN(RegExpInternalMatch, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kRegExp);
   Node* const string = Parameter(Descriptor::kString);
   Node* const context = Parameter(Descriptor::kContext);
 
   Node* const null = NullConstant();
-  Node* const smi_zero = SmiConstant(Smi::FromInt(0));
+  Node* const smi_zero = SmiConstant(0);
+
+  CSA_ASSERT(this, IsJSRegExp(regexp));
+  CSA_ASSERT(this, IsString(string));
 
   Node* const native_context = LoadNativeContext(context);
   Node* const internal_match_info = LoadContextElement(
       native_context, Context::REGEXP_INTERNAL_MATCH_INFO_INDEX);
 
   Node* const match_indices =
       IrregexpExec(context, regexp, string, smi_zero, internal_match_info);
 
   Label if_matched(this), if_didnotmatch(this);
   Branch(WordEqual(match_indices, null), &if_didnotmatch, &if_matched);
 
   BIND(&if_didnotmatch);
   Return(null);
 
   BIND(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, regexp, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8