[regexp] Avoid side effects between map load and fast path check

src/builtins/builtins-regexp.cc

Index: src/builtins/builtins-regexp.cc
diff --git a/src/builtins/builtins-regexp.cc b/src/builtins/builtins-regexp.cc
index 4003cfbf27e57f53149e6a17dcc8da808df5f5b6..f76136b8066d7850053a29fd53176bafbcc773dd 100644
--- a/src/builtins/builtins-regexp.cc
+++ b/src/builtins/builtins-regexp.cc
@@ -514,16 +514,16 @@ TF_BUILTIN(RegExpPrototypeExec, RegExpBuiltinsAssembler) {
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSRegExp.
-  Node* const regexp_map = ThrowIfNotInstanceType(
-      context, maybe_receiver, JS_REGEXP_TYPE, "RegExp.prototype.exec");
+  ThrowIfNotInstanceType(context, maybe_receiver, JS_REGEXP_TYPE,
+                         "RegExp.prototype.exec");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label if_isfastpath(this), if_isslowpath(this);
-  Branch(IsInitialRegExpMap(context, receiver, regexp_map), &if_isfastpath,
-         &if_isslowpath);
+  Branch(IsInitialRegExpMap(context, receiver, LoadMap(receiver)),
+         &if_isfastpath, &if_isslowpath);
 
   Bind(&if_isfastpath);
   {
@@ -1315,16 +1315,17 @@ TF_BUILTIN(RegExpPrototypeTest, RegExpBuiltinsAssembler) {
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.test");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.test");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &fast_path,
+                     &slow_path);
 
   Bind(&fast_path);
   {
@@ -1724,16 +1725,17 @@ TF_BUILTIN(RegExpPrototypeMatch, RegExpBuiltinsAssembler) {
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@match");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@match");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &fast_path,
+                     &slow_path);
 
   Bind(&fast_path);
   RegExpPrototypeMatchBody(context, receiver, string, true);
@@ -1849,16 +1851,17 @@ TF_BUILTIN(RegExpPrototypeSearch, RegExpBuiltinsAssembler) {
   Node* const context = Parameter(4);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@search");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@search");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
-  BranchIfFastRegExp(context, receiver, map, &fast_path, &slow_path);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &fast_path,
+                     &slow_path);
 
   Bind(&fast_path);
   RegExpPrototypeSearchBodyFast(context, receiver, string);
@@ -2185,16 +2188,16 @@ TF_BUILTIN(RegExpPrototypeSplit, RegExpBuiltinsAssembler) {
   Node* const context = Parameter(5);
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@split");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@split");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Node* const string = ToString(context, maybe_string);
 
   Label stub(this), runtime(this, Label::kDeferred);
-  BranchIfFastRegExp(context, receiver, map, &stub, &runtime);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &stub, &runtime);
 
   Bind(&stub);
   Callable split_callable = CodeFactory::RegExpSplit(isolate());
@@ -2609,9 +2612,9 @@ TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
   // }
 
   // Ensure {maybe_receiver} is a JSReceiver.
-  Node* const map = ThrowIfNotJSReceiver(
-      context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
-      "RegExp.prototype.@@replace");
+  ThrowIfNotJSReceiver(context, maybe_receiver,
+                       MessageTemplate::kIncompatibleMethodReceiver,
+                       "RegExp.prototype.@@replace");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
@@ -2620,7 +2623,7 @@ TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
 
   // Fast-path checks: 1. Is the {receiver} an unmodified JSRegExp instance?
   Label stub(this), runtime(this, Label::kDeferred);
-  BranchIfFastRegExp(context, receiver, map, &stub, &runtime);
+  BranchIfFastRegExp(context, receiver, LoadMap(receiver), &stub, &runtime);
 
   Bind(&stub);
   Callable replace_callable = CodeFactory::RegExpReplace(isolate());