[regexp] Ensure there are no shape changes on the fast path

src/builtins/builtins-regexp.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp.h"
 
 #include "src/builtins/builtins-constructor.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 229 matching lines @@
 
   Variable var_result(this, MachineRepresentation::kTagged);
   Label out(this);
 
   // Load lastIndex.
   Variable var_lastindex(this, MachineRepresentation::kTagged);
   {
     Node* const regexp_lastindex = LoadLastIndex(context, regexp, is_fastpath);
     var_lastindex.Bind(regexp_lastindex);
 
-    // Omit ToLength if lastindex is a non-negative smi.
-    Label call_tolength(this, Label::kDeferred), next(this);
-    Branch(TaggedIsPositiveSmi(regexp_lastindex), &next, &call_tolength);
+    if (is_fastpath) {
+      // ToLength on a positive smi is a nop and can be skipped.
+      CSA_ASSERT(this, TaggedIsPositiveSmi(regexp_lastindex));
+    } else {
+      // Omit ToLength if lastindex is a non-negative smi.
+      Label call_tolength(this, Label::kDeferred), next(this);
+      Branch(TaggedIsPositiveSmi(regexp_lastindex), &next, &call_tolength);
 
-    Bind(&call_tolength);
-    {
-      Callable tolength_callable = CodeFactory::ToLength(isolate);
-      var_lastindex.Bind(
-          CallStub(tolength_callable, context, regexp_lastindex));
-      Goto(&next);
+      Bind(&call_tolength);
+      {
+        Callable tolength_callable = CodeFactory::ToLength(isolate);
+        var_lastindex.Bind(
+            CallStub(tolength_callable, context, regexp_lastindex));
+        Goto(&next);
+      }
+
+      Bind(&next);
     }
-
-    Bind(&next);
   }
 
   // Check whether the regexp is global or sticky, which determines whether we
   // update last index later on.
   Node* const flags = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
   Node* const is_global_or_sticky = WordAnd(
       SmiUntag(flags), IntPtrConstant(JSRegExp::kGlobal | JSRegExp::kSticky));
   Node* const should_update_last_index =
       WordNotEqual(is_global_or_sticky, int_zero);
 
@@ skipping 128 matching lines @@
 
     CallRuntime(Runtime::kThrowTypeError, context, message_id, method_name_str,
                 value_str);
     Unreachable();
   }
 
   Bind(&out);
   return var_value_map.value();
 }
 
-Node* RegExpBuiltinsAssembler::IsInitialRegExpMap(Node* context, Node* map) {
+Node* RegExpBuiltinsAssembler::IsInitialRegExpMap(Node* context, Node* object,
+                                                  Node* map) {
+  Label out(this);
+  Variable var_result(this, MachineRepresentation::kWord32);
+
   Node* const native_context = LoadNativeContext(context);
   Node* const regexp_fun =
       LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX);
   Node* const initial_map =
       LoadObjectField(regexp_fun, JSFunction::kPrototypeOrInitialMapOffset);
   Node* const has_initialmap = WordEqual(map, initial_map);
 
-  return has_initialmap;
+  var_result.Bind(has_initialmap);
+  GotoIfNot(has_initialmap, &out);
+
+  // The smi check is required to omit ToLength(lastIndex) calls with possible
+  // user-code execution on the fast path.
+  Node* const last_index = FastLoadLastIndex(object);
+  var_result.Bind(TaggedIsPositiveSmi(last_index));
+  Goto(&out);
+
+  Bind(&out);
+  return var_result.value();
 }
 
 // RegExp fast path implementations rely on unmodified JSRegExp instances.
 // We use a fairly coarse granularity for this and simply check whether both
-// the regexp itself is unmodified (i.e. its map has not changed) and its
-// prototype is unmodified.
+// the regexp itself is unmodified (i.e. its map has not changed), its
+// prototype is unmodified, and lastIndex is a non-negative smi.
 void RegExpBuiltinsAssembler::BranchIfFastRegExp(Node* const context,
+                                                 Node* const object,
                                                  Node* const map,
                                                  Label* const if_isunmodified,
                                                  Label* const if_ismodified) {
+  CSA_ASSERT(this, WordEqual(LoadMap(object), map));
+
+  // TODO(ishell): Update this check once map changes for constant field
+  // tracking are landing.
+
   Node* const native_context = LoadNativeContext(context);
   Node* const regexp_fun =
       LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX);
   Node* const initial_map =
       LoadObjectField(regexp_fun, JSFunction::kPrototypeOrInitialMapOffset);
   Node* const has_initialmap = WordEqual(map, initial_map);
 
   GotoIfNot(has_initialmap, if_ismodified);
 
   Node* const initial_proto_initial_map =
       LoadContextElement(native_context, Context::REGEXP_PROTOTYPE_MAP_INDEX);
   Node* const proto_map = LoadMap(LoadMapPrototype(map));
   Node* const proto_has_initialmap =
       WordEqual(proto_map, initial_proto_initial_map);
 
-  // TODO(ishell): Update this check once map changes for constant field
-  // tracking are landing.
+  GotoIfNot(proto_has_initialmap, if_ismodified);
 
-  Branch(proto_has_initialmap, if_isunmodified, if_ismodified);
+  // The smi check is required to omit ToLength(lastIndex) calls with possible
+  // user-code execution on the fast path.
+  Node* const last_index = FastLoadLastIndex(object);
+  Branch(TaggedIsPositiveSmi(last_index), if_isunmodified, if_ismodified);
 }
 
 Node* RegExpBuiltinsAssembler::IsFastRegExpMap(Node* const context,
+                                               Node* const object,
                                                Node* const map) {
   Label yup(this), nope(this), out(this);
   Variable var_result(this, MachineRepresentation::kWord32);
 
-  BranchIfFastRegExp(context, map, &yup, &nope);
+  BranchIfFastRegExp(context, object, map, &yup, &nope);
 
   Bind(&yup);
   var_result.Bind(Int32Constant(1));
   Goto(&out);
 
   Bind(&nope);
   var_result.Bind(Int32Constant(0));
   Goto(&out);
 
   Bind(&out);
@@ skipping 20 matching lines @@
 
   // Ensure {maybe_receiver} is a JSRegExp.
   Node* const regexp_map = ThrowIfNotInstanceType(
       context, maybe_receiver, JS_REGEXP_TYPE, "RegExp.prototype.exec");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label if_isfastpath(this), if_isslowpath(this);
-  Branch(IsInitialRegExpMap(context, regexp_map), &if_isfastpath,
+  Branch(IsInitialRegExpMap(context, receiver, regexp_map), &if_isfastpath,
          &if_isslowpath);
 
   Bind(&if_isfastpath);
   {
     Node* const result =
         RegExpPrototypeExecBody(context, receiver, string, true);
     Return(result);
   }
 
   Bind(&if_isslowpath);
@@ skipping 166 matching lines @@
 TF_BUILTIN(RegExpPrototypeFlagsGetter, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const context = Parameter(3);
 
   Node* const map = ThrowIfNotJSReceiver(context, maybe_receiver,
                                          MessageTemplate::kRegExpNonObject,
                                          "RegExp.prototype.flags");
   Node* const receiver = maybe_receiver;
 
   Label if_isfastpath(this), if_isslowpath(this, Label::kDeferred);
-  Branch(IsInitialRegExpMap(context, map), &if_isfastpath, &if_isslowpath);
+  Branch(IsInitialRegExpMap(context, receiver, map), &if_isfastpath,
+         &if_isslowpath);
 
   Bind(&if_isfastpath);
   Return(FlagsGetter(context, receiver, true));
 
   Bind(&if_isslowpath);
   Return(FlagsGetter(context, receiver, false));
 }
 
 // ES#sec-regexp-pattern-flags
 // RegExp ( pattern, flags )
@@ skipping 519 matching lines @@
 Node* RegExpBuiltinsAssembler::RegExpExec(Node* context, Node* regexp,
                                           Node* string) {
   Isolate* isolate = this->isolate();
 
   Node* const null = NullConstant();
 
   Variable var_result(this, MachineRepresentation::kTagged);
   Label out(this), if_isfastpath(this), if_isslowpath(this);
 
   Node* const map = LoadMap(regexp);
-  BranchIfFastRegExp(context, map, &if_isfastpath, &if_isslowpath);
+  BranchIfFastRegExp(context, regexp, map, &if_isfastpath, &if_isslowpath);
 
   Bind(&if_isfastpath);
   {
     Node* const result = RegExpPrototypeExecBody(context, regexp, string, true);
     var_result.Bind(result);
     Goto(&out);
   }
 
   Bind(&if_isslowpath);
   {
@@ skipping 53 matching lines @@
   // Ensure {maybe_receiver} is a JSReceiver.
   Node* const map = ThrowIfNotJSReceiver(
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
       "RegExp.prototype.test");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
 
   Bind(&fast_path);
   {
     Label if_didnotmatch(this);
     RegExpPrototypeExecBodyWithoutResult(context, receiver, string,
                                          &if_didnotmatch, true);
     Return(TrueConstant());
 
     Bind(&if_didnotmatch);
     Return(FalseConstant());
@@ skipping 314 matching lines @@
         // Store the match, growing the fixed array if needed.
 
         array.Push(match);
 
         // Advance last index if the match is the empty string.
 
         Node* const match_length = LoadStringLength(match);
         GotoIfNot(SmiEqual(match_length, smi_zero), &loop);
 
         Node* last_index = LoadLastIndex(context, regexp, is_fastpath);
-
-        Callable tolength_callable = CodeFactory::ToLength(isolate);
-        last_index = CallStub(tolength_callable, context, last_index);
+        if (is_fastpath) {
+          CSA_ASSERT(this, TaggedIsPositiveSmi(last_index));
+        } else {
+          Callable tolength_callable = CodeFactory::ToLength(isolate);
+          last_index = CallStub(tolength_callable, context, last_index);
+        }
 
         Node* const new_last_index =
             AdvanceStringIndex(string, last_index, is_unicode);
 
+        if (is_fastpath) {
+          // On the fast path, we can be certain that lastIndex can never be
+          // incremented to overflow the Smi range since the maximal string
+          // length is less than the maximal Smi value.
+          STATIC_ASSERT(String::kMaxLength < Smi::kMaxValue);
+          CSA_ASSERT(this, TaggedIsPositiveSmi(new_last_index));
+        }
+
         StoreLastIndex(context, regexp, new_last_index, is_fastpath);
 
         Goto(&loop);
       }
     }
 
     Bind(&out);
     {
       // Wrap the match in a JSArray.
 
@@ skipping 13 matching lines @@
   // Ensure {maybe_receiver} is a JSReceiver.
   Node* const map = ThrowIfNotJSReceiver(
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
       "RegExp.prototype.@@match");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
 
   Bind(&fast_path);
   RegExpPrototypeMatchBody(context, receiver, string, true);
 
   Bind(&slow_path);
   RegExpPrototypeMatchBody(context, receiver, string, false);
 }
 
 void RegExpBuiltinsAssembler::RegExpPrototypeSearchBodyFast(
     Node* const context, Node* const regexp, Node* const string) {
@@ skipping 104 matching lines @@
   // Ensure {maybe_receiver} is a JSReceiver.
   Node* const map = ThrowIfNotJSReceiver(
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
       "RegExp.prototype.@@search");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
 
   Bind(&fast_path);
   RegExpPrototypeSearchBodyFast(context, receiver, string);
 
   Bind(&slow_path);
   RegExpPrototypeSearchBodySlow(context, receiver, string);
 }
 
 // Generates the fast path for @@split. {regexp} is an unmodified JSRegExp,
 // {string} is a String, and {limit} is a Smi.
@@ skipping 243 matching lines @@
 
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpSplit, RegExpBuiltinsAssembler) {
   typedef RegExpSplitDescriptor Descriptor;
 
   Node* const regexp = Parameter(Descriptor::kReceiver);
   Node* const string = Parameter(Descriptor::kString);
   Node* const maybe_limit = Parameter(Descriptor::kLimit);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, IsFastRegExpMap(context, LoadMap(regexp)));
+  CSA_ASSERT(this, IsFastRegExpMap(context, regexp, LoadMap(regexp)));
   CSA_ASSERT(this, IsString(string));
 
   // TODO(jgruber): Even if map checks send us to the fast path, we still need
   // to verify the constructor property and jump to the slow path if it has
   // been changed.
 
   // Convert {maybe_limit} to a uint32, capping at the maximal smi value.
-  Variable var_limit(this, MachineRepresentation::kTagged);
-  Label if_limitissmimax(this), limit_done(this);
+  Variable var_limit(this, MachineRepresentation::kTagged, maybe_limit);
+  Label if_limitissmimax(this), limit_done(this), runtime(this);
 
   GotoIf(IsUndefined(maybe_limit), &if_limitissmimax);
+  GotoIf(TaggedIsPositiveSmi(maybe_limit), &limit_done);
 
+  Node* const limit = ToUint32(context, maybe_limit);
   {
-    Node* const limit = ToUint32(context, maybe_limit);
+    // ToUint32(limit) could potentially change the shape of the RegExp
+    // object. Recheck that we are still on the fast path and bail to runtime
+    // otherwise.
+    {
+      Label next(this);
+      BranchIfFastRegExp(context, regexp, LoadMap(regexp), &next, &runtime);
+      Bind(&next);
+    }
+
     GotoIfNot(TaggedIsSmi(limit), &if_limitissmimax);
 
     var_limit.Bind(limit);
     Goto(&limit_done);
   }
 
   Bind(&if_limitissmimax);
   {
     // TODO(jgruber): In this case, we can probably avoid generation of limit
     // checks in Generate_RegExpPrototypeSplitBody.
     var_limit.Bind(SmiConstant(Smi::kMaxValue));
     Goto(&limit_done);
   }
 
   Bind(&limit_done);
   {
     Node* const limit = var_limit.value();
     RegExpPrototypeSplitBody(context, regexp, string, limit);
   }
+
+  Bind(&runtime);
+  {
+    // The runtime call passes in limit to ensure the second ToUint32(limit)
+    // call is not observable.
+    CSA_ASSERT(this, IsHeapNumberMap(LoadReceiverMap(limit)));
+    Return(CallRuntime(Runtime::kRegExpSplit, context, regexp, string, limit));
+  }
 }
 
 // ES#sec-regexp.prototype-@@split
 // RegExp.prototype [ @@split ] ( string, limit )
 TF_BUILTIN(RegExpPrototypeSplit, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const maybe_limit = Parameter(2);
   Node* const context = Parameter(5);
 
   // Ensure {maybe_receiver} is a JSReceiver.
   Node* const map = ThrowIfNotJSReceiver(
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
       "RegExp.prototype.@@split");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label stub(this), runtime(this, Label::kDeferred);
-  BranchIfFastRegExp(context, map, &stub, &runtime);
+  BranchIfFastRegExp(context, receiver, map, &stub, &runtime);
 
   Bind(&stub);
   Callable split_callable = CodeFactory::RegExpSplit(isolate());
   Return(CallStub(split_callable, context, receiver, string, maybe_limit));
 
   Bind(&runtime);
   Return(CallRuntime(Runtime::kRegExpSplit, context, receiver, string,
                      maybe_limit));
 }
 
@@ skipping 305 matching lines @@
 
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler) {
   typedef RegExpReplaceDescriptor Descriptor;
 
   Node* const regexp = Parameter(Descriptor::kReceiver);
   Node* const string = Parameter(Descriptor::kString);
   Node* const replace_value = Parameter(Descriptor::kReplaceValue);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, IsFastRegExpMap(context, LoadMap(regexp)));
+  CSA_ASSERT(this, IsFastRegExpMap(context, regexp, LoadMap(regexp)));
   CSA_ASSERT(this, IsString(string));
 
   Label checkreplacestring(this), if_iscallable(this),
       runtime(this, Label::kDeferred);
 
   // 2. Is {replace_value} callable?
   GotoIf(TaggedIsSmi(replace_value), &checkreplacestring);
   Branch(IsCallableMap(LoadMap(replace_value)), &if_iscallable,
          &checkreplacestring);
 
   // 3. Does ToString({replace_value}) contain '$'?
   Bind(&checkreplacestring);
   {
     Callable tostring_callable = CodeFactory::ToString(isolate());
     Node* const replace_string =
         CallStub(tostring_callable, context, replace_value);
 
+    // ToString(replaceValue) could potentially change the shape of the RegExp
+    // object. Recheck that we are still on the fast path and bail to runtime
+    // otherwise.
+    {
+      Label next(this);
+      BranchIfFastRegExp(context, regexp, LoadMap(regexp), &next, &runtime);
+      Bind(&next);
+    }
+
     Callable indexof_callable = CodeFactory::StringIndexOf(isolate());
     Node* const dollar_string = HeapConstant(
         isolate()->factory()->LookupSingleCharacterStringFromCode('$'));
     Node* const dollar_ix = CallStub(indexof_callable, context, replace_string,
                                      dollar_string, SmiConstant(0));
     GotoIfNot(SmiEqual(dollar_ix, SmiConstant(-1)), &runtime);
 
     Return(
         ReplaceSimpleStringFastPath(context, regexp, string, replace_string));
   }
@@ skipping 53 matching lines @@
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
       "RegExp.prototype.@@replace");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Callable tostring_callable = CodeFactory::ToString(isolate());
   Node* const string = CallStub(tostring_callable, context, maybe_string);
 
   // Fast-path checks: 1. Is the {receiver} an unmodified JSRegExp instance?
   Label stub(this), runtime(this, Label::kDeferred);
-  BranchIfFastRegExp(context, map, &stub, &runtime);
+  BranchIfFastRegExp(context, receiver, map, &stub, &runtime);
 
   Bind(&stub);
   Callable replace_callable = CodeFactory::RegExpReplace(isolate());
   Return(CallStub(replace_callable, context, receiver, string, replace_value));
 
   Bind(&runtime);
   Return(CallRuntime(Runtime::kRegExpReplace, context, receiver, string,
                      replace_value));
 }
 
@@ skipping 24 matching lines @@
   Bind(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, regexp, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8