[regexp] Avoid side effects between map load and fast path check

src/builtins/builtins-regexp.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp.h"
 
 #include "src/builtins/builtins-constructor.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 496 matching lines @@
 }
 
 // ES#sec-regexp.prototype.exec
 // RegExp.prototype.exec ( string )
 TF_BUILTIN(RegExpPrototypeExec, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSRegExp.
-  Node* const regexp_map = ThrowIfNotInstanceType(
-      context, maybe_receiver, JS_REGEXP_TYPE, "RegExp.prototype.exec");
+  ThrowIfNotInstanceType(context, maybe_receiver, JS_REGEXP_TYPE,
+                         "RegExp.prototype.exec");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label if_isfastpath(this), if_isslowpath(this);
-  Branch(IsInitialRegExpMap(context, receiver, regexp_map), &if_isfastpath,
-         &if_isslowpath);
+  Branch(IsInitialRegExpMap(context, receiver, LoadMap(receiver)),
+         &if_isfastpath, &if_isslowpath);
 
   Bind(&if_isfastpath);
   {
     Node* const result =
         RegExpPrototypeExecBody(context, receiver, string, true);
     Return(result);
   }
 
   Bind(&if_isslowpath);
   {
@@ skipping 771 matching lines @@
 }
 
 // ES#sec-regexp.prototype.test
 // RegExp.prototype.test ( S )
 TF_BUILTIN(RegExpPrototypeTest, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.test");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.test");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &fast_path,
+                     &slow_path);
 
   Bind(&fast_path);
   {
     Label if_didnotmatch(this);
     RegExpPrototypeExecBodyWithoutResult(context, receiver, string,
                                          &if_didnotmatch, true);
     Return(TrueConstant());
 
     Bind(&if_didnotmatch);
     Return(FalseConstant());
@@ skipping 379 matching lines @@
 }
 
 // ES#sec-regexp.prototype-@@match
 // RegExp.prototype [ @@match ] ( string )
 TF_BUILTIN(RegExpPrototypeMatch, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@match");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@match");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &fast_path,
+                     &slow_path);
 
   Bind(&fast_path);
   RegExpPrototypeMatchBody(context, receiver, string, true);
 
   Bind(&slow_path);
   RegExpPrototypeMatchBody(context, receiver, string, false);
 }
 
 void RegExpBuiltinsAssembler::RegExpPrototypeSearchBodyFast(
     Node* const context, Node* const regexp, Node* const string) {
@@ skipping 95 matching lines @@
 }
 
 // ES#sec-regexp.prototype-@@search
 // RegExp.prototype [ @@search ] ( string )
 TF_BUILTIN(RegExpPrototypeSearch, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@search");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@search");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &fast_path,
+                     &slow_path);
 
   Bind(&fast_path);
   RegExpPrototypeSearchBodyFast(context, receiver, string);
 
   Bind(&slow_path);
   RegExpPrototypeSearchBodySlow(context, receiver, string);
 }
 
 // Generates the fast path for @@split. {regexp} is an unmodified JSRegExp,
 // {string} is a String, and {limit} is a Smi.
@@ skipping 306 matching lines @@
 
 // ES#sec-regexp.prototype-@@split
 // RegExp.prototype [ @@split ] ( string, limit )
 TF_BUILTIN(RegExpPrototypeSplit, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const maybe_limit = Parameter(2);
   Node* const context = Parameter(5);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@split");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@split");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label stub(this), runtime(this, Label::kDeferred);
-  BranchIfFastRegExp(context, receiver, map, &stub, &runtime);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &stub, &runtime);
 
   Bind(&stub);
   Callable split_callable = CodeFactory::RegExpSplit(isolate());
   Return(CallStub(split_callable, context, receiver, string, maybe_limit));
 
   Bind(&runtime);
   Return(CallRuntime(Runtime::kRegExpSplit, context, receiver, string,
                      maybe_limit));
 }
 
@@ skipping 394 matching lines @@
   //   }
   // } else {
   //   if (replace.contains("$")) {
   //     CallRuntime(RegExpReplace)
   //   } else {
   //     ReplaceSimpleStringFastPath()  // Bails to runtime for global regexps.
   //   }
   // }
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@replace");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@replace");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Callable tostring_callable = CodeFactory::ToString(isolate());
   Node* const string = CallStub(tostring_callable, context, maybe_string);
 
   // Fast-path checks: 1. Is the {receiver} an unmodified JSRegExp instance?
   Label stub(this), runtime(this, Label::kDeferred);
-  BranchIfFastRegExp(context, receiver, map, &stub, &runtime);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &stub, &runtime);
 
   Bind(&stub);
   Callable replace_callable = CodeFactory::RegExpReplace(isolate());
   Return(CallStub(replace_callable, context, receiver, string, replace_value));
 
   Bind(&runtime);
   Return(CallRuntime(Runtime::kRegExpReplace, context, receiver, string,
                      replace_value));
 }
 
@@ skipping 24 matching lines @@
   Bind(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, regexp, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8