[regexp] Avoid runtime call on OOB lastIndex values

src/builtins/builtins-regexp-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp-gen.h"
 
 #include "src/builtins/builtins-constructor-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 288 matching lines @@
                SmiConstant(Isolate::kJSRegexpStaticOffsetsVectorSize / 2 - 1)),
            &runtime);
   }
 
   // Unpack the string if possible.
 
   to_direct.TryToDirect(&runtime);
 
   Node* const smi_string_length = LoadStringLength(string);
 
-  // Bail out to runtime for invalid {last_index} values.
-  GotoIfNot(TaggedIsSmi(last_index), &runtime);
-  GotoIf(SmiAboveOrEqual(last_index, smi_string_length), &runtime);
+  // At this point, last_index is definitely a canonicalized non-negative
+  // number, which implies that any non-Smi last_index is greater than
+  // the maximal string length. If lastIndex > string.length then the matcher
+  // must fail.
+
+  Label if_failure(this);
+  CSA_ASSERT(this, IsNumberNormalized(last_index));
+  CSA_ASSERT(this, IsNumberPositive(last_index));
+  GotoIfNot(TaggedIsSmi(last_index), &if_failure);  // Outside Smi range.
+  GotoIf(SmiGreaterThan(last_index, smi_string_length), &if_failure);
 
   // Load the irregexp code object and offsets into the subject string. Both
   // depend on whether the string is one- or two-byte.
 
   Node* const int_last_index = SmiUntag(last_index);
 
   VARIABLE(var_string_start, MachineType::PointerRepresentation());
   VARIABLE(var_string_end, MachineType::PointerRepresentation());
   VARIABLE(var_code, MachineRepresentation::kTagged);
 
@@ skipping 29 matching lines @@
   }
 
   // Check that the irregexp code has been generated for the actual string
   // encoding. If it has, the field contains a code object otherwise it contains
   // smi (code flushing support).
 
   Node* const code = var_code.value();
   GotoIf(TaggedIsSmi(code), &runtime);
   CSA_ASSERT(this, HasInstanceType(code, CODE_TYPE));
 
-  Label if_success(this), if_failure(this),
-      if_exception(this, Label::kDeferred);
+  Label if_success(this), if_exception(this, Label::kDeferred);
   {
     IncrementCounter(isolate()->counters()->regexp_entry_native(), 1);
 
     // Set up args for the final call into generated Irregexp code.
 
     MachineType type_int32 = MachineType::Int32();
     MachineType type_tagged = MachineType::AnyTagged();
     MachineType type_ptr = MachineType::Pointer();
 
     // Result: A NativeRegExpMacroAssembler::Result return code.
@@ skipping 2545 matching lines @@
   BIND(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, regexp, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8