[regexp] Avoid runtime call on OOB lastIndex values

src/builtins/builtins-regexp-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp-gen.h"
 
 #include "src/builtins/builtins-constructor-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 231 matching lines @@
 #ifdef V8_INTERPRETED_REGEXP
   return CallRuntime(Runtime::kRegExpExec, context, regexp, string, last_index,
                      match_info);
 #else   // V8_INTERPRETED_REGEXP
   CSA_ASSERT(this, TaggedIsNotSmi(regexp));
   CSA_ASSERT(this, IsJSRegExp(regexp));
 
   CSA_ASSERT(this, TaggedIsNotSmi(string));
   CSA_ASSERT(this, IsString(string));
 
   CSA_ASSERT(this, IsNumber(last_index));

[Jakob Kummerow, 2017/05/05 15:35:55]

nit: you can move the IsNumberNormalized check here to avoid duplication.

[jgruber, 2017/05/05 15:53:33]

I wanted to keep the assert close to relevant code (if you don't mind). The
latest patchset also adds an IsNumberPositive assertion.

   CSA_ASSERT(this, IsFixedArrayMap(LoadReceiverMap(match_info)));
 
   Node* const int_zero = IntPtrConstant(0);
 
   ToDirectStringAssembler to_direct(state(), string);
 
   VARIABLE(var_result, MachineRepresentation::kTagged);
   Label out(this), runtime(this, Label::kDeferred);
 
   // External constants.
@@ skipping 36 matching lines @@
                SmiConstant(Isolate::kJSRegexpStaticOffsetsVectorSize / 2 - 1)),
            &runtime);
   }
 
   // Unpack the string if possible.
 
   to_direct.TryToDirect(&runtime);
 
   Node* const smi_string_length = LoadStringLength(string);
 
-  // Bail out to runtime for invalid {last_index} values.
-  GotoIfNot(TaggedIsSmi(last_index), &runtime);
-  GotoIf(SmiAboveOrEqual(last_index, smi_string_length), &runtime);
+  // At this point, last_index is definitely a canonicalized non-negative
+  // number, which implies that any non-Smi last_index is greater than
+  // the maximal string length. If lastIndex > string.length then the matcher
+  // must fail.
+
+  Label if_failure(this);
+  CSA_ASSERT(this, IsNumberNormalized(last_index));
+  GotoIfNot(TaggedIsSmi(last_index), &if_failure);  // Outside Smi range.
+  GotoIf(SmiAbove(last_index, smi_string_length), &if_failure);
 
   // Load the irregexp code object and offsets into the subject string. Both
   // depend on whether the string is one- or two-byte.
 
   Node* const int_last_index = SmiUntag(last_index);
 
   VARIABLE(var_string_start, MachineType::PointerRepresentation());
   VARIABLE(var_string_end, MachineType::PointerRepresentation());
   VARIABLE(var_code, MachineRepresentation::kTagged);
 
@@ skipping 29 matching lines @@
   }
 
   // Check that the irregexp code has been generated for the actual string
   // encoding. If it has, the field contains a code object otherwise it contains
   // smi (code flushing support).
 
   Node* const code = var_code.value();
   GotoIf(TaggedIsSmi(code), &runtime);
   CSA_ASSERT(this, HasInstanceType(code, CODE_TYPE));
 
-  Label if_success(this), if_failure(this),
-      if_exception(this, Label::kDeferred);
+  Label if_success(this), if_exception(this, Label::kDeferred);
   {
     IncrementCounter(isolate()->counters()->regexp_entry_native(), 1);
 
     // Set up args for the final call into generated Irregexp code.
 
     MachineType type_int32 = MachineType::Int32();
     MachineType type_tagged = MachineType::AnyTagged();
     MachineType type_ptr = MachineType::Pointer();
 
     // Result: A NativeRegExpMacroAssembler::Result return code.
@@ skipping 2545 matching lines @@
   BIND(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, regexp, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8