ES6: Implement String.prototype.split and RegExp.prototype[@@split].
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 12 Apr 2016 22:40:25 +0000 (22:40 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 12 Apr 2016 22:40:25 +0000 (22:40 +0000)
https://bugs.webkit.org/show_bug.cgi?id=156013

Reviewed by Keith Miller.

Source/JavaScriptCore:

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/GlobalObject.js:
(speciesConstructor):
* builtins/PromisePrototype.js:
- refactored to use the @speciesConstructor internal function.

* builtins/RegExpPrototype.js:
(advanceStringIndex):
- refactored from @advanceStringIndexUnicode() to be match the spec.
  Benchmarks show that there's no advantage in doing the unicode check outside
  of the advanceStringIndexUnicode part.  So, I simplified the code to match the
  spec (especially since @@split needs to call advanceStringIndex from more than
  1 location).
(match):
- Removed an unnecessary call to @Object because it was already proven above.
- Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
  Again, there's no perf regression for this.
(regExpExec):
(hasObservableSideEffectsForRegExpSplit):
(split):
(advanceStringIndexUnicode): Deleted.

* builtins/StringPrototype.js:
(split):
- Modified to use RegExp.prototype[@@split].

* bytecode/BytecodeIntrinsicRegistry.cpp:
(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
(JSC::BytecodeIntrinsicRegistry::lookup):
* bytecode/BytecodeIntrinsicRegistry.h:
- Added the @@split symbol.

* runtime/CommonIdentifiers.h:
* runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
(JSC::esSpecIsConstructor):
(JSC::esSpecIsRegExp):
* runtime/ECMAScriptSpecInternalFunctions.h: Added.

* runtime/JSGlobalObject.cpp:
(JSC::getGetterById):
(JSC::JSGlobalObject::init):

* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::setDescriptor):
- Removed an assert that is no longer valid.

* runtime/RegExpObject.h:
- Made advanceStringUnicode() public so that it can be re-used by the regexp split
  fast path.

* runtime/RegExpPrototype.cpp:
(JSC::RegExpPrototype::finishCreation):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncSearch):
(JSC::advanceStringIndex):
(JSC::regExpProtoFuncSplitFast):
* runtime/RegExpPrototype.h:

* runtime/StringObject.h:
(JSC::jsStringWithReuse):
(JSC::jsSubstring):
- Hoisted some utility functions from StringPrototype.cpp so that they can be
  reused by the regexp split fast path.

* runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
(JSC::stringProtoFuncSplitFast):
(JSC::stringProtoFuncSubstr):
(JSC::builtinStringSubstrInternal):
(JSC::stringProtoFuncSubstring):
(JSC::stringIncludesImpl):
(JSC::stringProtoFuncIncludes):
(JSC::builtinStringIncludesInternal):
(JSC::jsStringWithReuse): Deleted.
(JSC::jsSubstring): Deleted.
(JSC::stringProtoFuncSplit): Deleted.
* runtime/StringPrototype.h:

* tests/es6.yaml:

LayoutTests:

* js/Object-getOwnPropertyNames-expected.txt:
* js/dom/string-prototype-properties-expected.txt:

* js/regress/regexp-prototype-split-observable-side-effects-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects2-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects2.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-flags.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-global.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-multiline.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-sticky.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-unicode.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects4-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects4.html: Added.

* js/regress/script-tests/regexp-prototype-split-observable-side-effects.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js: Added.

* js/regress/script-tests/string-prototype-split-observable-side-effects.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects2.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects4.js: Added.

* js/regress/string-prototype-split-observable-side-effects-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects.html: Added.
* js/regress/string-prototype-split-observable-side-effects2-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects2.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-flags.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-global-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-global.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-multiline.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-sticky.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-unicode.html: Added.
* js/regress/string-prototype-split-observable-side-effects4-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects4.html: Added.

* js/script-tests/Object-getOwnPropertyNames.js:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@199393 268f45cc-cd09-0410-ab3c-d52691b4dbfc

80 files changed:
LayoutTests/ChangeLog
LayoutTests/js/Object-getOwnPropertyNames-expected.txt
LayoutTests/js/dom/string-prototype-properties-expected.txt
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode.html [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4.html [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects2.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js [new file with mode: 0644]
LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects4.js [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects2-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects2.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode.html [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects4-expected.txt [new file with mode: 0644]
LayoutTests/js/regress/string-prototype-split-observable-side-effects4.html [new file with mode: 0644]
LayoutTests/js/script-tests/Object-getOwnPropertyNames.js
LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt
Source/JavaScriptCore/CMakeLists.txt
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
Source/JavaScriptCore/builtins/GlobalObject.js
Source/JavaScriptCore/builtins/PromisePrototype.js
Source/JavaScriptCore/builtins/RegExpPrototype.js
Source/JavaScriptCore/builtins/StringPrototype.js
Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp
Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h
Source/JavaScriptCore/runtime/CommonIdentifiers.h
Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.cpp [new file with mode: 0644]
Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.h [new file with mode: 0644]
Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
Source/JavaScriptCore/runtime/RegExpObject.h
Source/JavaScriptCore/runtime/RegExpPrototype.cpp
Source/JavaScriptCore/runtime/RegExpPrototype.h
Source/JavaScriptCore/runtime/StringObject.h
Source/JavaScriptCore/runtime/StringPrototype.cpp
Source/JavaScriptCore/runtime/StringPrototype.h
Source/JavaScriptCore/tests/es6.yaml

index f31023f..fe165d7 100644 (file)
@@ -1,3 +1,74 @@
+2016-04-12  Mark Lam  <mark.lam@apple.com>
+
+        ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Reviewed by Keith Miller.
+
+        * js/Object-getOwnPropertyNames-expected.txt:
+        * js/dom/string-prototype-properties-expected.txt:
+
+        * js/regress/regexp-prototype-split-observable-side-effects-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects2-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects2.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-flags.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-global.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-multiline.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-sticky.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-unicode.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects4-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects4.html: Added.
+
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js: Added.
+
+        * js/regress/script-tests/string-prototype-split-observable-side-effects.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects2.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects4.js: Added.
+
+        * js/regress/string-prototype-split-observable-side-effects-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects2-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects2.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-flags.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-global-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-global.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-multiline.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-sticky.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-unicode.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects4-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects4.html: Added.
+
+        * js/script-tests/Object-getOwnPropertyNames.js:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:
+
 2016-04-12  Chris Dumez  <cdumez@apple.com>
 
         Attr.value should not be nullable
index ece9097..363e359 100644 (file)
@@ -61,7 +61,7 @@ PASS getSortedOwnPropertyNames(Error) is ['length', 'name', 'prototype']
 PASS getSortedOwnPropertyNames(Error.prototype) is ['constructor', 'message', 'name', 'toString']
 PASS getSortedOwnPropertyNames(Math) is ['E','LN10','LN2','LOG10E','LOG2E','PI','SQRT1_2','SQRT2','abs','acos','acosh','asin','asinh','atan','atan2','atanh','cbrt','ceil','clz32','cos','cosh','exp','expm1','floor','fround','hypot','imul','log','log10','log1p','log2','max','min','pow','random','round','sign','sin','sinh','sqrt','tan','tanh','trunc']
 PASS getSortedOwnPropertyNames(JSON) is ['parse', 'stringify']
-PASS getSortedOwnPropertyNames(Symbol) is ['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'toPrimitive', 'toStringTag', 'unscopables']
+PASS getSortedOwnPropertyNames(Symbol) is ['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'split', 'toPrimitive', 'toStringTag', 'unscopables']
 PASS getSortedOwnPropertyNames(Symbol.prototype) is ['constructor', 'toString', 'valueOf']
 PASS getSortedOwnPropertyNames(Map) is ['length', 'name', 'prototype']
 PASS getSortedOwnPropertyNames(Map.prototype) is ['clear', 'constructor', 'delete', 'entries', 'forEach', 'get', 'has', 'keys', 'set', 'size', 'values']
index b2f906e..fe61241 100644 (file)
@@ -14,7 +14,7 @@ PASS String.prototype.match.call(undefined, /2+/) threw exception TypeError: Str
 PASS String.prototype.replace.call(undefined, /2+/, '-') threw exception TypeError: Type error.
 PASS String.prototype.search.call(undefined, '4') threw exception TypeError: String.prototype.search requires that |this| not be undefined.
 PASS String.prototype.slice.call(undefined, 1, 3) threw exception TypeError: Type error.
-PASS String.prototype.split.call(undefined, '2') threw exception TypeError: Type error.
+PASS String.prototype.split.call(undefined, '2') threw exception TypeError: String.prototype.split requires that |this| not be undefined.
 PASS String.prototype.slice.call(undefined, 1, 3) threw exception TypeError: Type error.
 PASS String.prototype.substr.call(undefined, 1, 3) threw exception TypeError: Type error.
 PASS String.prototype.substring.call(undefined, 1, 3) threw exception TypeError: Type error.
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects-expected.txt
new file mode 100644 (file)
index 0000000..be2ef7c
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects.html
new file mode 100644 (file)
index 0000000..7a4791a
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2-expected.txt
new file mode 100644 (file)
index 0000000..ccc6199
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects2
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2.html
new file mode 100644 (file)
index 0000000..a482ba5
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects2.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt
new file mode 100644 (file)
index 0000000..411c4e3
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects3-flags
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags.html
new file mode 100644 (file)
index 0000000..81e9e3f
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects3-flags.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt
new file mode 100644 (file)
index 0000000..f058f7e
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects3-global
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global.html
new file mode 100644 (file)
index 0000000..c5a1b5e
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects3-global.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt
new file mode 100644 (file)
index 0000000..05efd1e
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects3-ignoreCase
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html
new file mode 100644 (file)
index 0000000..61bc3a4
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt
new file mode 100644 (file)
index 0000000..7684708
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects3-multiline
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline.html
new file mode 100644 (file)
index 0000000..f9e872c
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects3-multiline.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt
new file mode 100644 (file)
index 0000000..9ce4f56
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects3-sticky
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky.html
new file mode 100644 (file)
index 0000000..b82dbad
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects3-sticky.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt
new file mode 100644 (file)
index 0000000..f509e7e
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects3-unicode
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode.html
new file mode 100644 (file)
index 0000000..92ee0e1
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects3-unicode.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4-expected.txt b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4-expected.txt
new file mode 100644 (file)
index 0000000..76f4606
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/regexp-prototype-split-observable-side-effects4
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4.html b/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4.html
new file mode 100644 (file)
index 0000000..6166056
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/regexp-prototype-split-observable-side-effects4.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects.js
new file mode 100644 (file)
index 0000000..a7644df
--- /dev/null
@@ -0,0 +1,406 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// Subclass with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp { }
+    Object.defineProperty(TestRegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+    let obj = new TestRegExp(/it/);
+    let errorStr;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "Symbol(Symbol.species)", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// RegExp subclass with constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        constructor(str, flags) {
+            super(str, flags);
+            accesses.push("constructor");
+        }
+    }
+    let obj = new TestRegExp("it");
+
+    assert(accesses == "constructor", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "constructor,constructor", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// An object with species constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push("constructor");
+        return /it/y;
+    };
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "constructor", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// RegExp object with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flags = [ "flags", "global", "ignoreCase", "multiline", "sticky", "unicode" ];
+    let flagValues = [ "", false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            let obj = /it/;
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    passed = true;
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == "", "unexpected call to overridden props");
+            let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+            assert(accesses == flag, "Property accesses do not match expectation");
+            assert(result == "spl,me", "Unexpected result");
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags in subclass method: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flags = [ "flags", "global", "ignoreCase", "multiline", "sticky", "unicode" ];
+    let flagValues = [ "", false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp {
+                get [flag]() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            };
+            let obj = new TestRegExp(/it/);
+
+            assert(accesses == "", "unexpected call to overridden props");
+            let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+            assert(accesses == flag, "Property accesses do not match expectation");
+            assert(result == "spl,me", "Unexpected result");
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags using Object.defineProperty: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flags = [ "flags", "global", "ignoreCase", "multiline", "sticky", "unicode" ];
+    let flagValues = [ "", false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp { };
+            let obj = new TestRegExp(/it/);
+
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == "", "unexpected call to overridden props");
+            let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+            assert(accesses == flag, "Property accesses do not match expectation");
+            assert(result == "spl,me", "Unexpected result");
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// Any object with species constructor: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push("constructor");
+        return /it/y;
+    };
+
+    Object.defineProperty(obj, "flags", {
+        get: function() {
+            accesses.push("flags");
+            return "";
+        }
+    });
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "flags,constructor", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Any object with custom prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+    let TestRegExpProto = {
+        get flags() {
+            accesses.push("flags");
+            return "";
+        },
+        toString() {
+            accesses.push("toString");
+            return this._regex.toString();
+        },
+        get source() {
+            accesses.push("source");
+            return this._regex.source;
+        }
+    }
+    TestRegExpProto.__proto__ = RegExp.prototype;
+
+    let TestRegExp = function(regex) {
+        accesses.push("constructor");
+        this._regex = new RegExp(regex);
+    }
+    TestRegExp.prototype = TestRegExpProto;
+    TestRegExpProto.constructor = TestRegExp;
+
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == "constructor", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "constructor,flags,source", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class RegExpB extends RegExp {
+        get flags() {
+            accesses.push("flags");
+            return "";
+        }
+    }
+    class RegExpC extends RegExpB { }
+
+    assert(RegExpB.__proto__ == RegExp);
+    assert(RegExpC.__proto__ == RegExpB);
+
+    let obj = new RegExpC(/it/);
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "flags", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses with substituted prototype before instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, "flags", {
+        get: function() {
+            accesses.push("flags");
+            return "";
+        }
+    });
+    Object.defineProperty(X.prototype, "exec", {
+        value: function(str) {
+            accesses.push("exec");
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of "it".
+            return matchResult;
+        }
+    });
+
+    // Monkey with the prototype chain before instantiating C.
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    let obj = new C;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "flags,exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses with substituted prototype after instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, "flags", {
+        get: function() {
+            accesses.push("flags");
+            return "";
+        }
+    });
+    Object.defineProperty(X.prototype, "exec", {
+        value: function(str) {
+            accesses.push("exec");
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of "it".
+            return matchResult;
+        }
+    });
+
+    // Instantiate C before monkeying with the prototype chain.
+    let obj = new C();
+
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "flags,exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses with proxied prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { };
+
+    assert(B.__proto__ === RegExp);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+
+    let proxy = new Proxy(RegExp.prototype, {
+        get: function(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop === "exec") {
+                return function(str) {
+                    accesses.push("in_exec");
+                    var matchResult = /it/y.exec(str.substr(this.lastIndex));
+                    if (matchResult)
+                        this.lastIndex += 2; // length of "it".
+                    return matchResult;
+                }
+            }
+            return obj[prop];
+        }
+    });
+    B.prototype.__proto__ = proxy;
+
+    let obj = new B();
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "flags,Symbol(Symbol.match),exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// RegExp subclass with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        exec(str) {
+            accesses.push("exec");
+            return RegExp.prototype.exec.call(this, str);
+        }
+    };
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Proxied RegExp observing every get.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(proxy, "splitme");
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == "constructor,flags,Symbol(Symbol.match),source",
+        "Proxy not able to observe some gets");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Proxied RegExp (without @@match) observing every get.
+// This is to force the RegExp @species constructor to access source.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop == Symbol.match)
+                return undefined;
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(proxy, "splitme");
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == "constructor,flags,Symbol(Symbol.match),Symbol(Symbol.toPrimitive),toString,source,flags",
+        "Proxy not able to observe some gets");
+    // The new instance of the RegExp would have been constructed with the pattern from
+    // the proxy toString() i.e. "\/lt\/" instead of source, because the proxy is an
+    // object without a [@@match] property.
+    assert(result == "splitme", "Unexpected result");
+})();
+
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js
new file mode 100644 (file)
index 0000000..cb47864
--- /dev/null
@@ -0,0 +1,25 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp, Symbol.species);
+    Object.defineProperty(RegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+    let obj = new RegExp;
+    let errorStr;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "Symbol(Symbol.species)", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js
new file mode 100644 (file)
index 0000000..89cbffa
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "flags";
+    let flagValue = "";
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js
new file mode 100644 (file)
index 0000000..8267b25
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "global";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js
new file mode 100644 (file)
index 0000000..0fc8640
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "ignoreCase";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js
new file mode 100644 (file)
index 0000000..2e8fc26
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "multiline";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js
new file mode 100644 (file)
index 0000000..5ed9560
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "sticky";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js
new file mode 100644 (file)
index 0000000..2212908
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "unicode";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js b/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js
new file mode 100644 (file)
index 0000000..3d6e0e2
--- /dev/null
@@ -0,0 +1,38 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, "exec");
+    let origExec = origDescriptor.value;
+
+    let obj = /it/;
+    Object.defineProperty(RegExp.prototype, "exec", {
+        value: function(str) {
+            accesses.push("exec");
+            return origExec.call(this, str);
+        }
+    });
+
+    // The @@split slow path should only call the internal version of substr. Make sure
+    // that it's not calling the public version which can be overridden.
+    String.prototype.substr = function(start, length) {
+        throw Error("Should not call overridden substr");
+    }
+
+    // The @@split slow path should only call the internal version of includes. Make sure
+    // that it's not calling the public version which can be overridden.
+    String.prototype.includes = function(pattern) {
+        throw Error("Should not call overridden includes");
+    }
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = RegExp.prototype[Symbol.split].call(obj, "splitme");
+    assert(accesses == "exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects.js
new file mode 100644 (file)
index 0000000..c43b8c1
--- /dev/null
@@ -0,0 +1,510 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+//======================================================================================
+// Testing the string that we're calling split on.
+
+// Proxied String subclass.
+(function () {
+    let accesses = [];
+    class ExtString extends String { }
+    var obj = new ExtString("splitme");
+    var proxy = new Proxy(obj, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop === "toString") {
+                return function() {
+                    accesses.push("in_toString");
+                    return obj.toString();
+                }
+            }
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = String.prototype.split.call(proxy, "it");    
+    assert(accesses == "Symbol(Symbol.toPrimitive),toString,in_toString", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Object that looks like a string.
+(function () {
+    let accesses = [];
+    var obj = {
+        [Symbol.toPrimitive]() {
+            accesses.push(Symbol.toPrimitive.toString());
+            return "splitme";
+        }
+    }
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = String.prototype.split.call(obj, "it");    
+    assert(accesses == "Symbol(Symbol.toPrimitive)", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Object that looks like a string.
+(function () {
+    let accesses = [];
+    var obj = {
+        toString() {
+            accesses.push("toString");
+            return "splitme";
+        }
+    }
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = String.prototype.split.call(obj, "it");    
+    assert(accesses == "toString", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// String subclass with overridden @@split.
+(function () {
+    let accesses = [];
+    class ExtString extends String {
+        [Symbol.split] (str) {
+            accesses.push("Symbol(Symbol.split)");
+            return RegExp.prototype[Symbol.split].call(/it/, str);
+        }
+    };
+
+    var obj = new ExtString;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);    
+    assert(accesses == "Symbol(Symbol.split)", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+
+// Object with overridden @@search.
+(function () {
+    let accesses = [];
+    var obj = {
+        [Symbol.split] (str) {
+            accesses.push("Symbol(Symbol.split)");
+            return RegExp.prototype[Symbol.split].call(/it/, str);
+        },
+    }
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);    
+    assert(accesses == "Symbol(Symbol.split)", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+//======================================================================================
+// Testing the regexp object that we're calling split with.
+
+// Subclass with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp { }
+    Object.defineProperty(TestRegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+    let obj = new TestRegExp;
+    let errorStr;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "Symbol(Symbol.species)", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// RegExp subclass with constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        constructor(str, flags) {
+            super(str, flags);
+            accesses.push("constructor");
+        }
+    }
+    let obj = new TestRegExp("it");
+
+    assert(accesses == "constructor", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "constructor,constructor", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// An object with species constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push("constructor");
+        return /it/y;
+    };
+    obj[Symbol.split] = function(str, limit) {
+        accesses.push(Symbol.split.toString());
+        return RegExp.prototype[Symbol.split].call(this, str, limit);
+    };
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "Symbol(Symbol.split),constructor", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// RegExp object with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flags = [ "flags", "global", "ignoreCase", "multiline", "sticky", "unicode" ];
+    let flagValues = [ "", false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            let obj = /it/;
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    passed = true;
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == "", "unexpected call to overridden props");
+            let result = "splitme".split(obj);
+            assert(accesses == flag, "Property accesses do not match expectation");
+            assert(result == "spl,me", "Unexpected result");
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags in subclass method: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flags = [ "flags", "global", "ignoreCase", "multiline", "sticky", "unicode" ];
+    let flagValues = [ "", false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp {
+                get [flag]() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            };
+            let obj = new TestRegExp(/it/);
+
+            assert(accesses == "", "unexpected call to overridden props");
+            let result = "splitme".split(obj);
+            assert(accesses == flag, "Property accesses do not match expectation");
+            assert(result == "spl,me", "Unexpected result");
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags using Object.defineProperty: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flags = [ "flags", "global", "ignoreCase", "multiline", "sticky", "unicode" ];
+    let flagValues = [ "", false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp { };
+            let obj = new TestRegExp(/it/);
+
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == "", "unexpected call to overridden props");
+            let result = "splitme".split(obj);
+            assert(accesses == flag, "Property accesses do not match expectation");
+            assert(result == "spl,me", "Unexpected result");
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// Any object with species constructor: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push("constructor");
+        return /it/y;
+    };
+    obj[Symbol.split] = function(str, limit) {
+        accesses.push(Symbol.split.toString());
+        return RegExp.prototype[Symbol.split].call(this, str, limit);
+    };
+
+    Object.defineProperty(obj, "flags", {
+        get: function() {
+            accesses.push("flags");
+            return "";
+        }
+    });
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "Symbol(Symbol.split),flags,constructor", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Any object with custom prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+    let TestRegExpProto = {
+        get flags() {
+            accesses.push("flags");
+            return "";
+        },
+        toString() {
+            accesses.push("toString");
+            return this._regex.toString();
+        },
+        get source() {
+            accesses.push("source");
+            return this._regex.source;
+        }
+    }
+    TestRegExpProto.__proto__ = RegExp.prototype;
+
+    let TestRegExp = function(regex) {
+        accesses.push("constructor");
+        this._regex = new RegExp(regex);
+    }
+    TestRegExp.prototype = TestRegExpProto;
+    TestRegExpProto.constructor = TestRegExp;
+
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == "constructor", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "constructor,flags,source", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class RegExpB extends RegExp {
+        get flags() {
+            accesses.push("flags");
+            return "";
+        }
+    }
+    class RegExpC extends RegExpB { }
+
+    assert(RegExpB.__proto__ == RegExp);
+    assert(RegExpC.__proto__ == RegExpB);
+
+    let obj = new RegExpC(/it/);
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "flags", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses with substituted prototype before instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, "flags", {
+        get: function() {
+            accesses.push("flags");
+            return "";
+        }
+    });
+    Object.defineProperty(X.prototype, "exec", {
+        value: function(str) {
+            accesses.push("exec");
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of "it".
+            return matchResult;
+        }
+    });
+
+    // Monkey with the prototype chain before instantiating C.
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    let obj = new C;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "flags,exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses with substituted prototype after instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, "flags", {
+        get: function() {
+            accesses.push("flags");
+            return "";
+        }
+    });
+    Object.defineProperty(X.prototype, "exec", {
+        value: function(str) {
+            accesses.push("exec");
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of "it".
+            return matchResult;
+        }
+    });
+
+    // Instantiate C before monkeying with the prototype chain.
+    let obj = new C();
+
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "flags,exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// 2 levels of subclasses with proxied prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { };
+
+    assert(B.__proto__ === RegExp);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+
+    let proxy = new Proxy(RegExp.prototype, {
+        get: function(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop === "exec") {
+                return function(str) {
+                    accesses.push("in_exec");
+                    var matchResult = /it/y.exec(str.substr(this.lastIndex));
+                    if (matchResult)
+                        this.lastIndex += 2; // length of "it".
+                    return matchResult;
+                }
+            }
+            return obj[prop];
+        }
+    });
+    B.prototype.__proto__ = proxy;
+
+    let obj = new B();
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "Symbol(Symbol.split),flags,Symbol(Symbol.match),exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// RegExp subclass with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        exec(str) {
+            accesses.push("exec");
+            return RegExp.prototype.exec.call(this, str);
+        }
+    };
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Proxied RegExp observing every get.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(proxy);
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == "Symbol(Symbol.split),constructor,flags,Symbol(Symbol.match),source",
+        "Proxy not able to observe some gets");
+    assert(result == "spl,me", "Unexpected result");
+})();
+
+// Proxied RegExp (without @@match) observing every get.
+// This is to force the RegExp @species constructor to access source.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop == Symbol.match)
+                return undefined;
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(proxy);
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == "Symbol(Symbol.split),constructor,flags,Symbol(Symbol.match),Symbol(Symbol.toPrimitive),toString,source,flags",
+        "Proxy not able to observe some gets");
+    // The new instance of the RegExp would have been constructed with the pattern from
+    // the proxy toString() i.e. "\/lt\/" instead of source, because the proxy is an
+    // object without a [@@match] property.
+    assert(result == "splitme", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects2.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects2.js
new file mode 100644 (file)
index 0000000..13b39ce
--- /dev/null
@@ -0,0 +1,26 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp, Symbol.species);
+    Object.defineProperty(RegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+
+    let obj = new RegExp;
+    let errorStr;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "Symbol(Symbol.species)", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js
new file mode 100644 (file)
index 0000000..f681c96
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "flags";
+    let flagValue = "";
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js
new file mode 100644 (file)
index 0000000..aee9d88
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "global";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js
new file mode 100644 (file)
index 0000000..c63a3c7
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "ignoreCase";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js
new file mode 100644 (file)
index 0000000..baa26f4
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "multiline";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js
new file mode 100644 (file)
index 0000000..e6764ab
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "sticky";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js
new file mode 100644 (file)
index 0000000..8c429c0
--- /dev/null
@@ -0,0 +1,28 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, "flags")).
+(function () {
+    let flag = "unicode";
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == flag, "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects4.js b/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects4.js
new file mode 100644 (file)
index 0000000..8998e1e
--- /dev/null
@@ -0,0 +1,38 @@
+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, "exec");
+    let origExec = origDescriptor.value;
+
+    let obj = /it/;
+    Object.defineProperty(RegExp.prototype, "exec", {
+        value: function(str) {
+            accesses.push("exec");
+            return origExec.call(this, str);
+        }
+    });
+
+    // The @@split slow path should call an internal version of substr. Make sure that
+    // it's not calling the public version which can be overridden.
+    String.prototype.substr = function(start, length) {
+        throw Error("Should not call overridden substr");
+    }
+
+    // The @@split slow path should only call the internal version of includes. Make sure
+    // that it's not calling the public version which can be overridden.
+    String.prototype.includes = function(pattern) {
+        throw Error("Should not call overridden includes");
+    }
+
+    assert(accesses == "", "unexpected call to overridden props");
+    let result = "splitme".split(obj);
+    assert(accesses == "exec,exec,exec,exec,exec,exec", "Property accesses do not match expectation");
+    assert(result == "spl,me", "Unexpected result");
+})();
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects-expected.txt
new file mode 100644 (file)
index 0000000..1725001
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects.html
new file mode 100644 (file)
index 0000000..313d643
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects2-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects2-expected.txt
new file mode 100644 (file)
index 0000000..72f6f58
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects2
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects2.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects2.html
new file mode 100644 (file)
index 0000000..3cb0036
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects2.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt
new file mode 100644 (file)
index 0000000..c44eca3
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects3-flags
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags.html
new file mode 100644 (file)
index 0000000..355d26d
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects3-flags.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global-expected.txt
new file mode 100644 (file)
index 0000000..84fddd5
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects3-global
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global.html
new file mode 100644 (file)
index 0000000..f01b56f
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects3-global.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt
new file mode 100644 (file)
index 0000000..6294596
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects3-ignoreCase
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html
new file mode 100644 (file)
index 0000000..b22f444
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt
new file mode 100644 (file)
index 0000000..2bc2549
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects3-multiline
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline.html
new file mode 100644 (file)
index 0000000..82d8715
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects3-multiline.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt
new file mode 100644 (file)
index 0000000..d86913d
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects3-sticky
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky.html
new file mode 100644 (file)
index 0000000..0b38ac5
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects3-sticky.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt
new file mode 100644 (file)
index 0000000..9cbbb09
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects3-unicode
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode.html
new file mode 100644 (file)
index 0000000..4f278ff
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects3-unicode.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects4-expected.txt b/LayoutTests/js/regress/string-prototype-split-observable-side-effects4-expected.txt
new file mode 100644 (file)
index 0000000..268ede3
--- /dev/null
@@ -0,0 +1,10 @@
+JSRegress/string-prototype-split-observable-side-effects4
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress/string-prototype-split-observable-side-effects4.html b/LayoutTests/js/regress/string-prototype-split-observable-side-effects4.html
new file mode 100644 (file)
index 0000000..80a8f5f
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/string-prototype-split-observable-side-effects4.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
+
index 2345df6..de6f997 100644 (file)
@@ -70,7 +70,7 @@ var expectedPropertyNamesSet = {
     "Error.prototype": "['constructor', 'message', 'name', 'toString']",
     "Math": "['E','LN10','LN2','LOG10E','LOG2E','PI','SQRT1_2','SQRT2','abs','acos','acosh','asin','asinh','atan','atan2','atanh','cbrt','ceil','clz32','cos','cosh','exp','expm1','floor','fround','hypot','imul','log','log10','log1p','log2','max','min','pow','random','round','sign','sin','sinh','sqrt','tan','tanh','trunc']",
     "JSON": "['parse', 'stringify']",
-    "Symbol": "['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'toPrimitive', 'toStringTag', 'unscopables']",
+    "Symbol": "['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'split', 'toPrimitive', 'toStringTag', 'unscopables']",
     "Symbol.prototype": "['constructor', 'toString', 'valueOf']",
     "Map": "['length', 'name', 'prototype']",
     "Map.prototype": "['clear', 'constructor', 'delete', 'entries', 'forEach', 'get', 'has', 'keys', 'set', 'size', 'values']",
index ee67f89..24fb029 100644 (file)
@@ -638,6 +638,7 @@ set(JavaScriptCore_SOURCES
     runtime/DirectArguments.cpp
     runtime/DirectArgumentsOffset.cpp
     runtime/DumpContext.cpp
+    runtime/ECMAScriptSpecInternalFunctions.cpp
     runtime/Error.cpp
     runtime/ErrorConstructor.cpp
     runtime/ErrorHandlingScope.cpp
index 79ff74f..5b9ff37 100644 (file)
@@ -1,3 +1,91 @@
+2016-04-12  Mark Lam  <mark.lam@apple.com>
+
+        ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/GlobalObject.js:
+        (speciesConstructor):
+        * builtins/PromisePrototype.js:
+        - refactored to use the @speciesConstructor internal function.
+
+        * builtins/RegExpPrototype.js:
+        (advanceStringIndex):
+        - refactored from @advanceStringIndexUnicode() to be match the spec.
+          Benchmarks show that there's no advantage in doing the unicode check outside
+          of the advanceStringIndexUnicode part.  So, I simplified the code to match the
+          spec (especially since @@split needs to call advanceStringIndex from more than
+          1 location).
+        (match):
+        - Removed an unnecessary call to @Object because it was already proven above.
+        - Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
+          Again, there's no perf regression for this.
+        (regExpExec):
+        (hasObservableSideEffectsForRegExpSplit):
+        (split):
+        (advanceStringIndexUnicode): Deleted.
+
+        * builtins/StringPrototype.js:
+        (split):
+        - Modified to use RegExp.prototype[@@split].
+
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        - Added the @@split symbol.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
+        (JSC::esSpecIsConstructor):
+        (JSC::esSpecIsRegExp):
+        * runtime/ECMAScriptSpecInternalFunctions.h: Added.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::getGetterById):
+        (JSC::JSGlobalObject::init):
+
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        - Removed an assert that is no longer valid.
+
+        * runtime/RegExpObject.h:
+        - Made advanceStringUnicode() public so that it can be re-used by the regexp split
+          fast path.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncSearch):
+        (JSC::advanceStringIndex):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/RegExpPrototype.h:
+
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        - Hoisted some utility functions from StringPrototype.cpp so that they can be
+          reused by the regexp split fast path.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::builtinStringSubstrInternal):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringIncludesImpl):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::jsStringWithReuse): Deleted.
+        (JSC::jsSubstring): Deleted.
+        (JSC::stringProtoFuncSplit): Deleted.
+        * runtime/StringPrototype.h:
+
+        * tests/es6.yaml:
+
 2016-04-12  Keith Miller  <keith_miller@apple.com>
 
         AbstractValue should use the result type to filter structures
index ff97a01..9ec806d 100644 (file)
                FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1C0FFE1B194FD100B53FCA /* Exception.cpp */; };
                FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
                FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
+               FE318FDF1CAC982700DFCC54 /* ECMAScriptSpecInternalFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */; };
+               FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */; };
                FE384EE51ADDB7AD0055DE2C /* JSDollarVM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */; };
                FE384EE61ADDB7AD0055DE2C /* JSDollarVM.h in Headers */ = {isa = PBXBuildFile; fileRef = FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */; settings = {ATTRIBUTES = (Private, ); }; };
                FE384EE71ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */; };
                FE1C0FFE1B194FD100B53FCA /* Exception.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Exception.cpp; sourceTree = "<group>"; };
                FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntCLoop.cpp; path = llint/LLIntCLoop.cpp; sourceTree = "<group>"; };
                FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCLoop.h; path = llint/LLIntCLoop.h; sourceTree = "<group>"; };
+               FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ECMAScriptSpecInternalFunctions.cpp; sourceTree = "<group>"; };
+               FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ECMAScriptSpecInternalFunctions.h; sourceTree = "<group>"; };
                FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVM.cpp; sourceTree = "<group>"; };
                FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDollarVM.h; sourceTree = "<group>"; };
                FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVMPrototype.cpp; sourceTree = "<group>"; };
                                0FE0500E1AA9091100D33B33 /* DirectArgumentsOffset.h */,
                                A70447EB17A0BD7000F5898E /* DumpContext.cpp */,
                                A70447EC17A0BD7000F5898E /* DumpContext.h */,
+                               FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */,
+                               FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */,
                                2AD2EDFA19799E38004D6478 /* EnumerationMode.h */,
                                BC337BEA0E1B00CB0076918A /* Error.cpp */,
                                BC3046060E1F497F003232CF /* Error.h */,
                                52C0611F1AA51E1C00B4ADBA /* RuntimeType.h in Headers */,
                                C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */,
                                0FE050281AA9095600D33B33 /* ScopedArguments.h in Headers */,
+                               FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */,
                                0FE050291AA9095600D33B33 /* ScopedArgumentsTable.h in Headers */,
                                0FE0502B1AA9095600D33B33 /* ScopeOffset.h in Headers */,
                                0F24E55217EE274900ABB217 /* ScratchRegisterAllocator.h in Headers */,
                                FE5068671AE25E280009DAB7 /* DeferredSourceDump.cpp in Sources */,
                                A77A423D17A0BBFD00A8DB81 /* DFGAbstractHeap.cpp in Sources */,
                                0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */,
+                               FE318FDF1CAC982700DFCC54 /* ECMAScriptSpecInternalFunctions.cpp in Sources */,
                                0FD3E4011B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp in Sources */,
                                0F18D3CF1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp in Sources */,
                                0F2DD8111AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp in Sources */,
index 5bcbc22..d28bf2b 100644 (file)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -60,3 +61,18 @@ function speciesGetter()
 {
     return this;
 }
+
+function speciesConstructor(obj, defaultConstructor)
+{
+    var constructor = obj.constructor;
+    if (constructor === @undefined)
+        return defaultConstructor;
+    if (!@isObject(constructor))
+        throw new @TypeError("|this|.constructor is not an Object or undefined");
+    constructor = constructor[@symbolSpecies];
+    if (constructor == null)
+        return defaultConstructor;
+    if (@isConstructor(constructor))
+        return constructor;
+    throw new @TypeError("|this|.constructor[Symbol.species] is not a constructor");
+}
index 4ae0304..3ea992f 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,16 +37,7 @@ function then(onFulfilled, onRejected)
     if (!@isPromise(this))
         throw new @TypeError("|this| is not a object");
 
-    var constructor = this.constructor;
-    if (constructor === @undefined)
-        constructor = @Promise;
-    else if (!@isObject(constructor))
-        throw new @TypeError("|this|.constructor is not an Object or undefined");
-    else {
-        constructor = constructor[@symbolSpecies];
-        if (constructor == null)
-            constructor = @Promise;
-    }
+    var constructor = @speciesConstructor(this, @Promise);
 
     var resultCapability = @newPromiseCapability(constructor);
 
index 1b6026b..5743b6c 100644 (file)
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-function advanceStringIndexUnicode(string, stringLength, index)
+function advanceStringIndex(string, index, unicode)
 {
-    // This function implements AdvanceStringIndex described in ES6 21.2.5.2.3, steps 6-11.
-    // It assumes that "unicode" is true for its callers.
+    // This function implements AdvanceStringIndex described in ES6 21.2.5.2.3.
     "use strict";
 
-    if (index + 1 >= stringLength)
+    if (!unicode)
+        return index + 1;
+
+    if (index + 1 >= string.length)
         return index + 1;
 
     let first = string.@charCodeAt(index);
@@ -47,10 +49,10 @@ function match(str)
 {
     "use strict";
 
-    if (!(this instanceof @Object))
+    if (!@isObject(this))
         throw new @TypeError("RegExp.prototype.@@match requires that |this| be an Object");
 
-    let regexp = @Object(this);
+    let regexp = this;
     let stringArg = @toString(str);
 
     if (!regexp.global)
@@ -79,12 +81,8 @@ function match(str)
 
             let resultString = @toString(result[0]);
 
-            if (!resultString.length) {
-                if (unicode)
-                    regexp.lastIndex = @advanceStringIndexUnicode(stringArg, stringLength, regexp.lastIndex);
-                else
-                    regexp.lastIndex++;
-            }
+            if (!resultString.length)
+                regexp.lastIndex = @advanceStringIndex(stringArg, regexp.lastIndex, unicode);
 
             resultList.@push(resultString);
 
@@ -95,3 +93,187 @@ function match(str)
     return regexp.@match(stringArg);
 }
 
+function regExpExec(regexp, str)
+{
+    "use strict";
+
+    let exec = regexp.exec;
+    let builtinExec = @RegExp.prototype.@exec;
+    if (exec !== builtinExec && typeof exec === "function") {
+        let result = exec.@call(regexp, str);
+        if (result !== null && !@isObject(result))
+            throw new @TypeError("The result of a RegExp exec must be null or an object");
+        return result;
+    }
+    return builtinExec.@call(regexp, str);
+}
+
+function hasObservableSideEffectsForRegExpSplit(regexp) {
+    // This is accessed by the RegExpExec internal function.
+    let regexpExec = @tryGetById(regexp, "exec");
+    if (regexpExec !== @RegExp.prototype.@exec)
+        return true;
+    
+    // This is accessed by step 5 below.
+    let regexpFlags = @tryGetById(regexp, "flags");
+    if (regexpFlags !== @regExpProtoFlagsGetter)
+        return true;
+    
+    // These are accessed by the builtin flags getter.
+    let regexpGlobal = @tryGetById(regexp, "global");
+    if (regexpGlobal !== @regExpProtoGlobalGetter)
+        return true;
+    let regexpIgnoreCase = @tryGetById(regexp, "ignoreCase");
+    if (regexpIgnoreCase !== @regExpProtoIgnoreCaseGetter)
+        return true;
+    let regexpMultiline = @tryGetById(regexp, "multiline");
+    if (regexpMultiline !== @regExpProtoMultilineGetter)
+        return true;
+    let regexpSticky = @tryGetById(regexp, "sticky");
+    if (regexpSticky !== @regExpProtoStickyGetter)
+        return true;
+    let regexpUnicode = @tryGetById(regexp, "unicode");
+    if (regexpUnicode !== @regExpProtoUnicodeGetter)
+        return true;
+    
+    // This is accessed by the RegExp species constructor.
+    let regexpSource = @tryGetById(regexp, "source");
+    if (regexpSource !== @regExpProtoSourceGetter)
+        return true;
+    
+    return !@isRegExp(regexp);
+}
+
+// ES 21.2.5.11 RegExp.prototype[@@split](string, limit)
+function split(string, limit)
+{
+    "use strict";
+
+    // 1. Let rx be the this value.
+    // 2. If Type(rx) is not Object, throw a TypeError exception.
+    if (!@isObject(this))
+        throw new @TypeError("RegExp.prototype.@@split requires that |this| be an Object");
+    let regexp = this;
+
+    // 3. Let S be ? ToString(string).
+    let str = @toString(string);
+
+    // 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+    let speciesConstructor = @speciesConstructor(regexp, @RegExp);
+
+    if (speciesConstructor === @RegExp && !@hasObservableSideEffectsForRegExpSplit(regexp))
+        return @regExpSplitFast.@call(regexp, str, limit);
+
+    // 5. Let flags be ? ToString(? Get(rx, "flags")).
+    let flags = @toString(regexp.flags);
+
+    // 6. If flags contains "u", let unicodeMatching be true.
+    // 7. Else, let unicodeMatching be false.
+    let unicodeMatching = @stringIncludesInternal.@call(flags, "u");
+    // 8. If flags contains "y", let newFlags be flags.
+    // 9. Else, let newFlags be the string that is the concatenation of flags and "y".
+    let newFlags = @stringIncludesInternal.@call(flags, "y") ? flags : flags + "y";
+
+    // 10. Let splitter be ? Construct(C, « rx, newFlags »).
+    let splitter = new speciesConstructor(regexp, newFlags);
+
+    // We need to check again for RegExp subclasses that will fail the speciesConstructor test
+    // but can still use the fast path after we invoke the constructor above.
+    if (!@hasObservableSideEffectsForRegExpSplit(splitter))
+        return @regExpSplitFast.@call(splitter, str, limit);
+
+    // 11. Let A be ArrayCreate(0).
+    // 12. Let lengthA be 0.
+    let result = [];
+
+    // 13. If limit is undefined, let lim be 2^32-1; else let lim be ? ToUint32(limit).
+    limit = (limit === @undefined) ? 0xffffffff : limit >>> 0;
+
+    // 16. If lim = 0, return A.
+    if (!limit)
+        return result;
+
+    // 14. [Defered from above] Let size be the number of elements in S.
+    let size = str.length;
+
+    // 17. If size = 0, then
+    if (!size) {
+        // a. Let z be ? RegExpExec(splitter, S).
+        let z = @regExpExec(splitter, str);
+        // b. If z is not null, return A.
+        if (z != null)
+            return result;
+        // c. Perform ! CreateDataProperty(A, "0", S).
+        @putByValDirect(result, 0, str);
+        // d. Return A.
+        return result;
+    }
+
+    // 15. [Defered from above] Let p be 0.
+    let position = 0;
+    // 18. Let q be p.
+    let matchPosition = 0;
+
+    // 19. Repeat, while q < size
+    while (matchPosition < size) {
+        // a. Perform ? Set(splitter, "lastIndex", q, true).
+        splitter.lastIndex = matchPosition;
+        // b. Let z be ? RegExpExec(splitter, S).
+        let matches = @regExpExec(splitter, str);
+        // c. If z is null, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (matches === null)
+            matchPosition = @advanceStringIndex(str, matchPosition, unicodeMatching);
+        // d. Else z is not null,
+        else {
+            // i. Let e be ? ToLength(? Get(splitter, "lastIndex")).
+            let endPosition = @toLength(splitter.lastIndex);
+            // ii. Let e be min(e, size).
+            endPosition = (endPosition <= size) ? endPosition : size;
+            // iii. If e = p, let q be AdvanceStringIndex(S, q, unicodeMatching).
+            if (endPosition === position)
+                matchPosition = @advanceStringIndex(str, matchPosition, unicodeMatching);
+            // iv. Else e != p,
+            else {
+                // 1. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through q (exclusive).
+                let subStr = @stringSubstrInternal.@call(str, position, matchPosition - position);
+                // 2. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+                // 3. Let lengthA be lengthA + 1.
+                @putByValDirect(result, result.length, subStr);
+                // 4. If lengthA = lim, return A.
+                if (result.length == limit)
+                    return result;
+
+                // 5. Let p be e.
+                position = endPosition;
+                // 6. Let numberOfCaptures be ? ToLength(? Get(z, "length")).
+                // 7. Let numberOfCaptures be max(numberOfCaptures-1, 0).
+                let numberOfCaptures = matches.length > 1 ? matches.length - 1 : 0;
+
+                // 8. Let i be 1.
+                let i = 1;
+                // 9. Repeat, while i <= numberOfCaptures,
+                while (i <= numberOfCaptures) {
+                    // a. Let nextCapture be ? Get(z, ! ToString(i)).
+                    let nextCapture = matches[i];
+                    // b. Perform ! CreateDataProperty(A, ! ToString(lengthA), nextCapture).
+                    // d. Let lengthA be lengthA + 1.
+                    @putByValDirect(result, result.length, nextCapture);
+                    // e. If lengthA = lim, return A.
+                    if (result.length == limit)
+                        return result;
+                    // c. Let i be i + 1.
+                    i++;
+                }
+                // 10. Let q be p.
+                matchPosition = position;
+            }
+        }
+    }
+    // 20. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through size (exclusive).
+    let remainingStr = @stringSubstrInternal.@call(str, position, size);
+    // 21. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+    @putByValDirect(result, result.length, remainingStr);
+    // 22. Return A.
+    return result;
+}
+
index 2da6405..dbd6300 100644 (file)
@@ -125,3 +125,22 @@ function repeat(count)
 
     return @repeatSlowPath(string, count);
 }
+
+function split(separator, limit)
+{
+    "use strict";
+    
+    if (this == null) {
+        if (this === null)
+            throw new @TypeError("String.prototype.split requires that |this| not be null");
+        throw new @TypeError("String.prototype.split requires that |this| not be undefined");
+    }
+    
+    if (separator != null) {
+        var splitter = separator[@symbolSplit];
+        if (splitter != @undefined)
+            return splitter.@call(separator, this, limit);
+    }
+    
+    return @stringSplitFast.@call(this, separator, limit);
+}
index bbbc3ff..39a4e6a 100644 (file)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -56,6 +57,7 @@ BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry(VM& vm)
     m_symbolMatch.set(m_vm, Symbol::create(m_vm, static_cast<SymbolImpl&>(*m_vm.propertyNames->matchSymbol.impl())));
     m_symbolSearch.set(m_vm, Symbol::create(m_vm, static_cast<SymbolImpl&>(*m_vm.propertyNames->searchSymbol.impl())));
     m_symbolSpecies.set(m_vm, Symbol::create(m_vm, static_cast<SymbolImpl&>(*m_vm.propertyNames->speciesSymbol.impl())));
+    m_symbolSplit.set(m_vm, Symbol::create(m_vm, static_cast<SymbolImpl&>(*m_vm.propertyNames->splitSymbol.impl())));
 }
 
 BytecodeIntrinsicNode::EmitterType BytecodeIntrinsicRegistry::lookup(const Identifier& ident) const
index 40352a1..ae28bc9 100644 (file)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,6 +60,7 @@ class Identifier;
     macro(symbolMatch) \
     macro(symbolSearch) \
     macro(symbolSpecies) \
+    macro(symbolSplit) \
 
 class BytecodeIntrinsicRegistry {
     WTF_MAKE_NONCOPYABLE(BytecodeIntrinsicRegistry);
index a086ded..74b1a0e 100644 (file)
 #define JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL_NOT_IMPLEMENTED_YET(macro)\
     macro(isConcatSpreadable) \
     macro(replace) \
-    macro(split)
 
 #define JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(macro) \
     macro(hasInstance) \
     macro(match) \
     macro(search) \
     macro(species) \
+    macro(split) \
     macro(toPrimitive) \
     macro(toStringTag) \
     macro(unscopables)
     macro(instanceOf) \
     macro(isArray) \
     macro(isArrayConstructor) \
+    macro(isConstructor) \
+    macro(isRegExp) \
     macro(isSet) \
     macro(isMap) \
     macro(regExpCreate) \
     macro(setIteratorNext) \
     macro(MapIterator) \
     macro(mapIteratorNext) \
-
+    macro(regExpProtoFlagsGetter) \
+    macro(regExpProtoGlobalGetter) \
+    macro(regExpProtoIgnoreCaseGetter) \
+    macro(regExpProtoMultilineGetter) \
+    macro(regExpProtoSourceGetter) \
+    macro(regExpProtoStickyGetter) \
+    macro(regExpProtoUnicodeGetter) \
+    macro(regExpSplitFast) \
+    macro(stringIncludesInternal) \
+    macro(stringSplitFast) \
+    macro(stringSubstrInternal) \
 
 namespace JSC {
     
diff --git a/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.cpp b/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.cpp
new file mode 100644 (file)
index 0000000..47780d7
--- /dev/null
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ECMAScriptSpecInternalFunctions.h"
+
+#include "CallFrame.h"
+#include "ConstructData.h"
+#include "JSCJSValueInlines.h"
+#include "ProxyObject.h"
+#include "RegExpObject.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL esSpecIsConstructor(ExecState* exec)
+{
+    bool isConstructor = exec->argument(0).isConstructor();
+    return JSValue::encode(jsBoolean(isConstructor));
+}
+
+EncodedJSValue JSC_HOST_CALL esSpecIsRegExp(ExecState* exec)
+{
+    bool isRegExp = exec->argument(0).inherits(RegExpObject::info());
+    return JSValue::encode(jsBoolean(isRegExp));
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.h b/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.h
new file mode 100644 (file)
index 0000000..f6ea59c
--- /dev/null
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ECMAScriptSpecInternalFunctions_h
+#define ECMAScriptSpecInternalFunctions_h
+
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL esSpecIsConstructor(ExecState*);
+EncodedJSValue JSC_HOST_CALL esSpecIsRegExp(ExecState*);
+
+} // namespace JSC
+
+#endif // ECMAScriptSpecInternalFunctions_h
index 098ef6a..84407c6 100644 (file)
@@ -45,6 +45,7 @@
 #include "Debugger.h"
 #include "DebuggerScope.h"
 #include "DirectArguments.h"
+#include "ECMAScriptSpecInternalFunctions.h"
 #include "Error.h"
 #include "ErrorConstructor.h"
 #include "ErrorPrototype.h"
@@ -256,6 +257,15 @@ void JSGlobalObject::setGlobalThis(VM& vm, JSObject* globalThis)
     m_globalThis.set(vm, this, globalThis);
 }
 
+
+static JSObject* getGetterById(ExecState* exec, JSObject* base, const Identifier& ident)
+{
+    JSValue baseValue = JSValue(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+    baseValue.getPropertySlot(exec, ident, slot);
+    return slot.getPureResult().toObject(exec);
+}
+
 void JSGlobalObject::init(VM& vm)
 {
     ASSERT(vm.currentThreadIsHoldingAPILock());
@@ -540,6 +550,14 @@ putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Construct
     JSFunction* privateFuncThisTimeValue = JSFunction::create(vm, this, 0, String(), dateProtoFuncGetTime);
     JSFunction* privateFuncIsArrayConstructor = JSFunction::create(vm, this, 0, String(), arrayConstructorPrivateFuncIsArrayConstructor);
 
+    JSObject* regExpProtoFlagsGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->flags);
+    JSObject* regExpProtoGlobalGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->global);
+    JSObject* regExpProtoIgnoreCaseGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->ignoreCase);
+    JSObject* regExpProtoMultilineGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->multiline);
+    JSObject* regExpProtoSourceGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->source);
+    JSObject* regExpProtoStickyGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->sticky);
+    JSObject* regExpProtoUnicodeGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->unicode);
+    
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(vm.propertyNames->NaN, jsNaN(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->Infinity, jsNumber(std::numeric_limits<double>::infinity()), DontEnum | DontDelete | ReadOnly),
@@ -596,7 +614,6 @@ putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Construct
         GlobalPropertyInfo(vm.propertyNames->builtinNames().promiseReactionJobPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsPromiseReactionJobCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().promiseResolveThenableJobPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsPromiseResolveThenableJobCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().InspectorInstrumentationPrivateName(), InspectorInstrumentationObject::create(vm, this, InspectorInstrumentationObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum | DontDelete | ReadOnly),
-        GlobalPropertyInfo(vm.propertyNames->builtinNames().advanceStringIndexUnicodePrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeAdvanceStringIndexUnicodeCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->MapPrivateName, mapConstructor, DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().generatorResumePrivateName(), JSFunction::createBuiltinFunction(vm, generatorPrototypeGeneratorResumeCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().thisTimeValuePrivateName(), privateFuncThisTimeValue, DontEnum | DontDelete | ReadOnly),
@@ -606,7 +623,29 @@ putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Construct
         GlobalPropertyInfo(vm.propertyNames->builtinNames().NumberFormatPrivateName(), intl->getDirect(vm, vm.propertyNames->NumberFormat), DontEnum | DontDelete | ReadOnly),
 #endif // ENABLE(INTL)
 
+        GlobalPropertyInfo(vm.propertyNames->isConstructorPrivateName, JSFunction::create(vm, this, 1, String(), esSpecIsConstructor, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->isRegExpPrivateName, JSFunction::create(vm, this, 1, String(), esSpecIsRegExp, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().speciesConstructorPrivateName(), JSFunction::createBuiltinFunction(vm, globalObjectSpeciesConstructorCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+
+        GlobalPropertyInfo(vm.propertyNames->regExpProtoFlagsGetterPrivateName, regExpProtoFlagsGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->regExpProtoGlobalGetterPrivateName, regExpProtoGlobalGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->regExpProtoIgnoreCaseGetterPrivateName, regExpProtoIgnoreCaseGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->regExpProtoMultilineGetterPrivateName, regExpProtoMultilineGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->regExpProtoSourceGetterPrivateName, regExpProtoSourceGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->regExpProtoStickyGetterPrivateName, regExpProtoStickyGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->regExpProtoUnicodeGetterPrivateName, regExpProtoUnicodeGetterObject, DontEnum | DontDelete | ReadOnly),
+
+        // RegExp.prototype helpers.
         GlobalPropertyInfo(vm.propertyNames->regExpCreatePrivateName, JSFunction::create(vm, this, 2, String(), esSpecRegExpCreate, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().hasObservableSideEffectsForRegExpSplitPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeHasObservableSideEffectsForRegExpSplitCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().advanceStringIndexPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeAdvanceStringIndexCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpExecPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeRegExpExecCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->regExpSplitFastPrivateName, JSFunction::create(vm, this, 2, String(), regExpProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
+
+        // String.prototype helpers.
+        GlobalPropertyInfo(vm.propertyNames->stringIncludesInternalPrivateName, JSFunction::create(vm, this, 1, String(), builtinStringIncludesInternal), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->stringSplitFastPrivateName, JSFunction::create(vm, this, 2, String(), stringProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->stringSubstrInternalPrivateName, JSFunction::create(vm, this, 2, String(), builtinStringSubstrInternal), DontEnum | DontDelete | ReadOnly),
     };
     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
     
index c2128c4..2caf58c 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -114,7 +114,6 @@ JSObject* PropertyDescriptor::setterObject() const
 void PropertyDescriptor::setDescriptor(JSValue value, unsigned attributes)
 {
     ASSERT(value);
-    ASSERT(value.isGetterSetter() == !!(attributes & Accessor));
 
     m_attributes = attributes;
     if (value.isGetterSetter()) {
index eb9d448..bb02a57 100644 (file)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 20072008, 2012, 2016 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -93,6 +93,8 @@ public:
         return OBJECT_OFFSETOF(RegExpObject, m_lastIndexIsWritable);
     }
 
+    static unsigned advanceStringUnicode(String, unsigned length, unsigned currentIndex);
+
 protected:
     JS_EXPORT_PRIVATE RegExpObject(VM&, Structure*, RegExp*);
     JS_EXPORT_PRIVATE void finishCreation(VM&);
@@ -104,7 +106,6 @@ protected:
     JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
     JS_EXPORT_PRIVATE static void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
     JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
-    unsigned advanceStringUnicode(String, unsigned, unsigned);
 
 private:
     MatchResult matchInline(ExecState*, JSGlobalObject*, JSString*);
index b0691de..4baa633 100644 (file)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 20072008, 2016 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2007-2008, 2016 Apple Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -39,6 +39,7 @@
 #include "RegExpCache.h"
 #include "RegExpConstructor.h"
 #include "RegExpMatchesArray.h"
+#include "StringObject.h"
 #include "StringRecursionChecker.h"
 
 namespace JSC {
@@ -81,6 +82,7 @@ void RegExpPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().matchPrivateName(), regExpProtoFuncMatchPrivate, DontEnum | DontDelete | ReadOnly, 1);
     JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->matchSymbol, regExpPrototypeMatchCodeGenerator, DontEnum);
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->searchSymbol, regExpProtoFuncSearch, DontEnum, 1);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->splitSymbol, regExpPrototypeSplitCodeGenerator, DontEnum);
 
     JSFunction* execFunction = JSFunction::create(vm, globalObject, 1, vm.propertyNames->exec.string(), regExpProtoFuncExec, RegExpExecIntrinsic);
     putDirectWithoutTransition(vm, vm.propertyNames->execPrivateName, execFunction, DontEnum | DontDelete | ReadOnly);
@@ -115,7 +117,7 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec)
 {
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(RegExpObject::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, "Builtin RegExp exec can only be called on a RegExp object");
     JSString* string = exec->argument(0).toStringOrNull(exec);
     if (!string)
         return JSValue::encode(jsUndefined());
@@ -434,4 +436,167 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncSearch(ExecState* exec)
     return JSValue::encode(result ? jsNumber(result.start) : jsNumber(-1));
 }
 
+static inline unsigned advanceStringIndex(String str, unsigned strSize, unsigned index, bool isUnicode)
+{
+    if (!isUnicode)
+        return ++index;
+    return RegExpObject::advanceStringUnicode(str, strSize, index);
+}
+
+// ES 21.2.5.11 RegExp.prototype[@@split](string, limit)
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+
+    // 1. [handled by JS builtin] Let rx be the this value.
+    // 2. [handled by JS builtin] If Type(rx) is not Object, throw a TypeError exception.
+    JSValue thisValue = exec->thisValue();
+    RegExp* regexp = asRegExpObject(thisValue)->regExp();
+
+    // 3. [handled by JS builtin] Let S be ? ToString(string).
+    String input = exec->argument(0).toString(exec)->value(exec);
+    if (vm.exception())
+        return JSValue::encode(jsUndefined());
+    ASSERT(!input.isNull());
+
+    // 4. [handled by JS builtin] Let C be ? SpeciesConstructor(rx, %RegExp%).
+    // 5. [handled by JS builtin] Let flags be ? ToString(? Get(rx, "flags")).
+    // 6. [handled by JS builtin] If flags contains "u", let unicodeMatching be true.
+    // 7. [handled by JS builtin] Else, let unicodeMatching be false.
+    // 8. [handled by JS builtin] If flags contains "y", let newFlags be flags.
+    // 9. [handled by JS builtin] Else, let newFlags be the string that is the concatenation of flags and "y".
+    // 10. [handled by JS builtin] Let splitter be ? Construct(C, « rx, newFlags »).
+
+    // 11. Let A be ArrayCreate(0).
+    // 12. Let lengthA be 0.
+    JSArray* result = constructEmptyArray(exec, 0);
+    unsigned resultLength = 0;
+
+    // 13. If limit is undefined, let lim be 2^32-1; else let lim be ? ToUint32(limit).
+    JSValue limitValue = exec->argument(1);
+    unsigned limit = limitValue.isUndefined() ? 0xFFFFFFFFu : limitValue.toUInt32(exec);
+
+    // 14. Let size be the number of elements in S.
+    unsigned inputSize = input.length();
+
+    // 15. Let p = 0.
+    unsigned position = 0;
+
+    // 16. If lim == 0, return A.
+    if (!limit)
+        return JSValue::encode(result);
+
+    // 17. If size == 0, then
+    if (input.isEmpty()) {
+        // a. Let z be ? RegExpExec(splitter, S).
+        // b. If z is not null, return A.
+        // c. Perform ! CreateDataProperty(A, "0", S).
+        // d. Return A.
+        if (!regexp->match(vm, input, 0))
+            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
+        return JSValue::encode(result);
+    }
+
+    // 18. Let q = p.
+    unsigned matchPosition = position;
+    // 19. Repeat, while q < size
+    bool regExpIsSticky = regexp->sticky();
+    bool regExpIsUnicode = regexp->unicode();
+    while (matchPosition < inputSize) {
+        Vector<int, 32> ovector;
+
+        // a. Perform ? Set(splitter, "lastIndex", q, true).
+        // b. Let z be ? RegExpExec(splitter, S).
+        int mpos = regexp->match(vm, input, matchPosition, ovector);
+
+        // c. If z is null, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (mpos < 0) {
+            if (!regExpIsSticky)
+                break;
+            matchPosition = advanceStringIndex(input, inputSize, matchPosition, regExpIsUnicode);
+            continue;
+        }
+        if (static_cast<unsigned>(mpos) >= inputSize) {
+            // The spec redoes the RegExpExec starting at the next character of the input.
+            // But in our case, mpos < 0 means that the native regexp already searched all permutations
+            // and know that we won't be able to find a match for the separator even if we redo the
+            // RegExpExec starting at the next character of the input. So, just bail.
+            break;
+        }
+
+        // d. Else, z is not null
+        //    i. Let e be ? ToLength(? Get(splitter, "lastIndex")).
+        //   ii. Let e be min(e, size).
+        matchPosition = mpos;
+        unsigned matchEnd = ovector[1];
+
+        //  iii. If e = p, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (matchEnd == position) {
+            matchPosition = advanceStringIndex(input, inputSize, matchPosition, regExpIsUnicode);
+            continue;
+        }
+        // if matchEnd == 0 then position should also be zero and thus matchEnd should equal position.
+        ASSERT(matchEnd);
+
+        //   iv. Else e != p,
+        {
+            unsigned numberOfCaptures = regexp->numSubpatterns();
+            unsigned newResultLength = resultLength + numberOfCaptures + 1;
+            if (newResultLength < numberOfCaptures || newResultLength >= MAX_STORAGE_VECTOR_INDEX) {
+                // Let's consider what's best for users here. We're about to increase the length of
+                // the split array beyond the maximum length that we can support efficiently. This
+                // will cause us to use a HashMap for the new entries after this point. That's going
+                // to result in a very long running time of this function and very large memory
+                // usage. In my experiments, JSC will sit spinning for minutes after getting here and
+                // it was using >4GB of memory and eventually grew to 8GB. It kept running without
+                // finishing until I killed it. That's probably not what the user wanted. The user,
+                // or the program that the user is running, probably made a mistake by calling this
+                // method in such a way that it resulted in such an obnoxious array. Therefore, to
+                // protect ourselves, we bail at this point.
+                throwOutOfMemoryError(exec);
+                return JSValue::encode(jsUndefined());
+            }
+
+            // 1. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through q (exclusive).
+            // 2. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+            result->putDirectIndex(exec, resultLength, jsSubstring(exec, thisValue, input, position, matchPosition - position));
+
+            // 3. Let lengthA be lengthA + 1.
+            // 4. If lengthA = lim, return A.
+            if (++resultLength == limit)
+                return JSValue::encode(result);
+
+            // 5. Let p be e.
+            position = matchEnd;
+
+            // 6. Let numberOfCaptures be ? ToLength(? Get(z, "length")).
+            // 7. Let numberOfCaptures be max(numberOfCaptures-1, 0).
+            // 8. Let i be 1.
+            // 9. Repeat, while i <= numberOfCaptures,
+            for (unsigned i = 1; i <= numberOfCaptures; ++i) {
+                // a. Let nextCapture be ? Get(z, ! ToString(i)).
+                // b. Perform ! CreateDataProperty(A, ! ToString(lengthA), nextCapture).
+                int sub = ovector[i * 2];
+                result->putDirectIndex(exec, resultLength, sub < 0 ? jsUndefined() : jsSubstring(exec, thisValue, input, sub, ovector[i * 2 + 1] - sub));
+
+                // c. Let i be i + 1.
+                // d. Let lengthA be lengthA + 1.
+                // e. If lengthA = lim, return A.
+                if (++resultLength == limit)
+                    return JSValue::encode(result);
+            }
+
+            // 10. Let q be p.
+            matchPosition = position;
+        }
+    }
+
+    // 20. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through size (exclusive).
+    // 21. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+    result->putDirectIndex(exec, resultLength++, jsSubstring(exec, thisValue, input, position, inputSize - position));
+
+    // 22. Return A.
+    return JSValue::encode(result);
+}
+
 } // namespace JSC
index 6cfce5d..cc68126 100644 (file)
@@ -58,6 +58,8 @@ private:
     WriteBarrier<RegExp> m_emptyRegExp;
 };
 
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState*);
+
 } // namespace JSC
 
 #endif // RegExpPrototype_h
index 4f89697..ed2a5b5 100644 (file)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007-2008, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -81,6 +81,29 @@ inline StringObject* asStringObject(JSValue value)
 
 JS_EXPORT_PRIVATE StringObject* constructString(VM&, JSGlobalObject*, JSValue);
 
+// Helper for producing a JSString for 'string', where 'string' was been produced by
+// calling ToString on 'originalValue'. In cases where 'originalValue' already was a
+// string primitive we can just use this, otherwise we need to allocate a new JSString.
+static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue, const String& string)
+{
+    if (originalValue.isString()) {
+        ASSERT(asString(originalValue)->value(exec) == string);
+        return asString(originalValue);
+    }
+    return jsString(exec, string);
+}
+
+// Helper that tries to use the JSString substring sharing mechanism if 'originalValue' is a JSString.
+static inline JSString* jsSubstring(ExecState* exec, JSValue originalValue, const String& string, unsigned offset, unsigned length)
+{
+    if (originalValue.isString()) {
+        ASSERT(asString(originalValue)->value(exec) == string);
+        return jsSubstring(exec, asString(originalValue), offset, length);
+    }
+    return jsSubstring(exec, string, offset, length);
+}
+
+
 } // namespace JSC
 
 #endif // StringObject_h
index f6b1ea4..00c51d0 100644 (file)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2013, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004-2008, 2013, 2016 Apple Inc. All rights reserved.
  *  Copyright (C) 2009 Torch Mobile, Inc.
  *  Copyright (C) 2015 Jordan Harband (ljharb@gmail.com)
  *
@@ -70,7 +70,6 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncPadEnd(ExecState*);
 EncodedJSValue JSC_HOST_CALL stringProtoFuncPadStart(ExecState*);
 EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState*);
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState*);
-EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState*);
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState*);
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState*);
 EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState*);
@@ -113,6 +112,7 @@ const ClassInfo StringPrototype::s_info = { "String", &StringObject::s_info, &st
     match     JSBuiltin    DontEnum|Function 1
     repeat    JSBuiltin    DontEnum|Function 1
     search    JSBuiltin    DontEnum|Function 1
+    split     JSBuiltin    DontEnum|Function 1
 @end
 */
 
@@ -139,7 +139,6 @@ void StringPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject, JSStr
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("padStart", stringProtoFuncPadStart, DontEnum, 1);
     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION("replace", stringProtoFuncReplace, DontEnum, 2, StringPrototypeReplaceIntrinsic);
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("slice", stringProtoFuncSlice, DontEnum, 2);
-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("split", stringProtoFuncSplit, DontEnum, 2);
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("substr", stringProtoFuncSubstr, DontEnum, 2);
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("substring", stringProtoFuncSubstring, DontEnum, 2);
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("toLowerCase", stringProtoFuncToLowerCase, DontEnum, 0);
@@ -195,28 +194,6 @@ bool StringPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, Prop
 
 // ------------------------------ Functions --------------------------
 
-// Helper for producing a JSString for 'string', where 'string' was been produced by
-// calling ToString on 'originalValue'. In cases where 'originalValue' already was a
-// string primitive we can just use this, otherwise we need to allocate a new JSString.
-static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue, const String& string)
-{
-    if (originalValue.isString()) {
-        ASSERT(asString(originalValue)->value(exec) == string);
-        return asString(originalValue);
-    }
-    return jsString(exec, string);
-}
-
-// Helper that tries to use the JSString substring sharing mechanism if 'originalValue' is a JSString.
-static inline JSString* jsSubstring(ExecState* exec, JSValue originalValue, const String& string, unsigned offset, unsigned length)
-{
-    if (originalValue.isString()) {
-        ASSERT(asString(originalValue)->value(exec) == string);
-        return jsSubstring(exec, asString(originalValue), offset, length);
-    }
-    return jsSubstring(exec, string, offset, length);
-}
-
 static NEVER_INLINE String substituteBackreferencesSlow(StringView replacement, StringView source, const int* ovector, RegExp* reg, size_t i)
 {
     StringBuilder substitutedReplacement;
@@ -1181,169 +1158,58 @@ static ALWAYS_INLINE bool splitStringByOneCharacterImpl(ExecState* exec, JSArray
     return false;
 }
 
-// ES 5.1 - 15.5.4.14 String.prototype.split (separator, limit)
-EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
+// ES 21.1.3.17 String.prototype.split(separator, limit)
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSplitFast(ExecState* exec)
 {
-    // 1. Call CheckObjectCoercible passing the this value as its argument.
     JSValue thisValue = exec->thisValue();
-    if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+    ASSERT(checkObjectCoercible(thisValue));
 
-    // 2. Let S be the result of calling ToString, giving it the this value as its argument.
-    // 6. Let s be the number of characters in S.
+    // 3. Let S be the result of calling ToString, giving it the this value as its argument.
+    // 7. Let s be the number of characters in S.
     String input = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     ASSERT(!input.isNull());
 
-    // 3. Let A be a new array created as if by the expression new Array()
+    // 4. Let A be a new array created as if by the expression new Array()
     //    where Array is the standard built-in constructor with that name.
     JSArray* result = constructEmptyArray(exec, 0);
 
-    // 4. Let lengthA be 0.
+    // 5. Let lengthA be 0.
     unsigned resultLength = 0;
 
-    // 5. If limit is undefined, let lim = 2^32-1; else let lim = ToUint32(limit).
-    JSValue limitValue = exec->argument(1);
+    // 6. If limit is undefined, let lim = 2^32-1; else let lim = ToUint32(limit).
+    JSValue limitValue = exec->uncheckedArgument(1);
     unsigned limit = limitValue.isUndefined() ? 0xFFFFFFFFu : limitValue.toUInt32(exec);
 
-    // 7. Let p = 0.
+    // 8. Let p = 0.
     size_t position = 0;
 
-    // 8. If separator is a RegExp object (its [[Class]] is "RegExp"), let R = separator;
+    // 9. If separator is a RegExp object (its [[Class]] is "RegExp"), let R = separator;
     //    otherwise let R = ToString(separator).
-    JSValue separatorValue = exec->argument(0);
-    if (separatorValue.inherits(RegExpObject::info())) {
-        VM* vm = &exec->vm();
-        RegExp* reg = asRegExpObject(separatorValue)->regExp();
-
-        // 9. If lim == 0, return A.
-        if (!limit)
-            return JSValue::encode(result);
-
-        // 10. If separator is undefined, then
-        if (separatorValue.isUndefined()) {
-            // a. Call the [[DefineOwnProperty]] internal method of A with arguments "0",
-            //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
-            // b. Return A.
-            return JSValue::encode(result);
-        }
-
-        // 11. If s == 0, then
-        if (input.isEmpty()) {
-            // a. Call SplitMatch(S, 0, R) and let z be its MatchResult result.
-            // b. If z is not failure, return A.
-            // c. Call the [[DefineOwnProperty]] internal method of A with arguments "0",
-            //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            // d. Return A.
-            if (!reg->match(*vm, input, 0))
-                result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
-            return JSValue::encode(result);
-        }
-
-        // 12. Let q = p.
-        size_t matchPosition = 0;
-        // 13. Repeat, while q != s
-        while (matchPosition < input.length()) {
-            // a. Call SplitMatch(S, q, R) and let z be its MatchResult result.
-            Vector<int, 32> ovector;
-            int mpos = reg->match(*vm, input, matchPosition, ovector);
-
-            // b. If z is a failure then we can break because there are no matches
-            if (mpos < 0)
-                break;
-            matchPosition = mpos;
-
-            // if the match is the empty match at the end, break.
-            if (matchPosition >= input.length())
-                break;
-
-            // c. Else, z is not failure
-            // i. z must be a State. Let e be z's endIndex and let cap be z's captures array.
-            size_t matchEnd = ovector[1];
-
-            // ii. If e == p, then let q = q + 1.
-            if (matchEnd == position) {
-                ++matchPosition;
-                continue;
-            }
-            // iii. if matchEnd == 0 then position should also be zero and thus matchEnd should equal position.
-            ASSERT(matchEnd);
-
-            // iii. Else, e != p
-
-            // 1. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
-            //    through q (exclusive).
-            // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
-            //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->putDirectIndex(exec, resultLength, jsSubstring(exec, thisValue, input, position, matchPosition - position));
-
-            // 3. Increment lengthA by 1.
-            // 4. If lengthA == lim, return A.
-            ++resultLength;
-            if (resultLength == limit)
-                return JSValue::encode(result);
-            if (resultLength >= MAX_STORAGE_VECTOR_INDEX) {
-                // Let's consider what's best for users here. We're about to increase the length of
-                // the split array beyond the maximum length that we can support efficiently. This
-                // will cause us to use a HashMap for the new entries after this point. That's going
-                // to result in a very long running time of this function and very large memory
-                // usage. In my experiments, JSC will sit spinning for minutes after getting here and
-                // it was using >4GB of memory and eventually grew to 8GB. It kept running without
-                // finishing until I killed it. That's probably not what the user wanted. The user,
-                // or the program that the user is running, probably made a mistake by calling this
-                // method in such a way that it resulted in such an obnoxious array. Therefore, to
-                // protect ourselves, we bail at this point.
-                throwOutOfMemoryError(exec);
-                return JSValue::encode(jsUndefined());
-            }
-
-            // 5. Let p = e.
-            // 8. Let q = p.
-            position = matchEnd;
-            matchPosition = matchEnd;
-
-            // 6. Let i = 0.
-            // 7. Repeat, while i is not equal to the number of elements in cap.
-            //  a Let i = i + 1.
-            for (unsigned i = 1; i <= reg->numSubpatterns(); ++i) {
-                // b Call the [[DefineOwnProperty]] internal method of A with arguments
-                //   ToString(lengthA), Property Descriptor {[[Value]]: cap[i], [[Writable]]:
-                //   true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-                int sub = ovector[i * 2];
-                result->putDirectIndex(exec, resultLength, sub < 0 ? jsUndefined() : jsSubstring(exec, thisValue, input, sub, ovector[i * 2 + 1] - sub));
-                // c Increment lengthA by 1.
-                // d If lengthA == lim, return A.
-                if (++resultLength == limit)
-                    return JSValue::encode(result);
-            }
-        }
-    } else {
+    JSValue separatorValue = exec->uncheckedArgument(0);
+    { // FIXME: Keeping this indentation here to minimize the diff. Will unindent and remove this later.
         String separator = separatorValue.toString(exec)->value(exec);
         if (exec->hadException())
             return JSValue::encode(jsUndefined());
 
-        // 9. If lim == 0, return A.
+        // 10. If lim == 0, return A.
         if (!limit)
             return JSValue::encode(result);
 
-        // 10. If separator is undefined, then
-        JSValue separatorValue = exec->argument(0);
+        // 11. If separator is undefined, then
         if (separatorValue.isUndefined()) {
             // a.  Call the [[DefineOwnProperty]] internal method of A with arguments "0",
-            //     Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
             result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
             // b.  Return A.
             return JSValue::encode(result);
         }
 
-        // 11. If s == 0, then
+        // 12. If s == 0, then
         if (input.isEmpty()) {
-            // a. Call SplitMatch(S, 0, R) and let z be its MatchResult result.
-            // b. If z is not failure, return A.
-            // c. Call the [[DefineOwnProperty]] internal method of A with arguments "0",
-            //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
+            // a. Let z be SplitMatch(S, 0, R) where S is input, R is separator.
+            // b. If z is not false, return A.
+            // c. Call CreateDataProperty(A, "0", S).
             // d. Return A.
             if (!separator.isEmpty())
                 result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
@@ -1386,17 +1252,16 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
                     return JSValue::encode(result);
             }
         } else {
-            // 12. Let q = p.
+            // 13. Let q = p.
             size_t matchPosition;
-            // 13. Repeat, while q != s
-            //   a. Call SplitMatch(S, q, R) and let z be its MatchResult result.
-            //   b. If z is failure, then let q = q+1.
-            //   c. Else, z is not failure
+            // 14. Repeat, while q != s
+            //   a. let e be SplitMatch(S, q, R).
+            //   b. If e is failure, then let q = q+1.
+            //   c. Else, e is an integer index <= s.
             while ((matchPosition = stringImpl->find(separatorImpl, position)) != notFound) {
                 // 1. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
                 //    through q (exclusive).
-                // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
-                //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
+                // 2. Call CreateDataProperty(A, ToString(lengthA), T).
                 result->putDirectIndex(exec, resultLength, jsSubstring(exec, thisValue, input, position, matchPosition - position));
                 // 3. Increment lengthA by 1.
                 // 4. If lengthA == lim, return A.
@@ -1404,19 +1269,18 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
                     return JSValue::encode(result);
 
                 // 5. Let p = e.
-                // 8. Let q = p.
+                // 6. Let q = p.
                 position = matchPosition + separator.length();
             }
         }
-    }
+    } // FIXME: Keeping this indentation here to minimize the diff. Will unindent and remove this later.
 
-    // 14. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
+    // 15. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
     //     through s (exclusive).
-    // 15. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA), Property Descriptor
-    //     {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
+    // 16. Call CreateDataProperty(A, ToString(lengthA), T).
     result->putDirectIndex(exec, resultLength++, jsSubstring(exec, thisValue, input, position, input.length() - position));
 
-    // 16. Return A.
+    // 17. Return A.
     return JSValue::encode(result);
 }
 
@@ -1459,6 +1323,23 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec)
     return JSValue::encode(jsSubstring(exec, uString, substringStart, substringLength));
 }
 
+EncodedJSValue JSC_HOST_CALL builtinStringSubstrInternal(ExecState* exec)
+{
+    // @substrInternal should not have any observable side effects (e.g. it should not call
+    // GetMethod(..., @@toPrimitive) on the thisValue).
+
+    // It is ok to use the default stringProtoFuncSubstr as the implementation of
+    // @substrInternal because @substrInternal will only be called by builtins, which will
+    // guarantee that we only pass it a string thisValue. As a result, stringProtoFuncSubstr
+    // will not need to call toString() on the thisValue, and there will be no observable
+    // side-effects.
+#if !ASSERT_DISABLED
+    JSValue thisValue = exec->thisValue();
+    ASSERT(thisValue.isString());
+#endif
+    return stringProtoFuncSubstr(exec);
+}
+
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec)
 {
     JSValue thisValue = exec->thisValue();
@@ -1995,6 +1876,21 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncEndsWith(ExecState* exec)
     return JSValue::encode(jsBoolean(stringToSearchIn.hasInfixEndingAt(searchString, std::min(end, length))));
 }
 
+static EncodedJSValue JSC_HOST_CALL stringIncludesImpl(VM& vm, ExecState* exec, String stringToSearchIn, String searchString, JSValue positionArg)
+{
+    unsigned start = 0;
+    if (positionArg.isInt32())
+        start = std::max(0, positionArg.asInt32());
+    else {
+        unsigned length = stringToSearchIn.length();
+        start = clampAndTruncateToUnsigned(positionArg.toInteger(exec), 0, length);
+        if (vm.exception())
+            return JSValue::encode(jsUndefined());
+    }
+
+    return JSValue::encode(jsBoolean(stringToSearchIn.contains(searchString, true, start)));
+}
+
 EncodedJSValue JSC_HOST_CALL stringProtoFuncIncludes(ExecState* exec)
 {
     JSValue thisValue = exec->thisValue();
@@ -2018,17 +1914,28 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncIncludes(ExecState* exec)
         return JSValue::encode(jsUndefined());
 
     JSValue positionArg = exec->argument(1);
-    unsigned start = 0;
-    if (positionArg.isInt32())
-        start = std::max(0, positionArg.asInt32());
-    else {
-        unsigned length = stringToSearchIn.length();
-        start = clampAndTruncateToUnsigned(positionArg.toInteger(exec), 0, length);
-        if (exec->hadException())
-            return JSValue::encode(jsUndefined());
-    }
 
-    return JSValue::encode(jsBoolean(stringToSearchIn.contains(searchString, true, start)));
+    return stringIncludesImpl(vm, exec, stringToSearchIn, searchString, positionArg);
+}
+
+EncodedJSValue JSC_HOST_CALL builtinStringIncludesInternal(ExecState* exec)
+{
+    JSValue thisValue = exec->thisValue();
+    ASSERT(checkObjectCoercible(thisValue));
+
+    String stringToSearchIn = thisValue.toString(exec)->value(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    JSValue a0 = exec->uncheckedArgument(0);
+    VM& vm = exec->vm();
+    String searchString = a0.toString(exec)->value(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    JSValue positionArg = exec->argument(1);
+
+    return stringIncludesImpl(vm, exec, stringToSearchIn, searchString, positionArg);
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncIterator(ExecState* exec)
index ce64284..c9ce06d 100644 (file)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 20072008, 2013, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007-2008, 2013, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -66,6 +66,10 @@ EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceRegExpString(
 String substituteBackreferences(const String& replacement, StringView source, const int* ovector, RegExp* reg);
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncRepeatCharacter(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSplitFast(ExecState*);
+
+EncodedJSValue JSC_HOST_CALL builtinStringSubstrInternal(ExecState*);
+EncodedJSValue JSC_HOST_CALL builtinStringIncludesInternal(ExecState*);
 
 } // namespace JSC
 
index 78435cc..78931cd 100644 (file)
 - path: es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js
   cmd: runES6 :fail
 - path: es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.split].js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_RegExp_constructor.js
   cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_String.prototype.match.js
 - path: es6/Proxy_internal_get_calls_String.prototype.search.js
   cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_String.prototype.split.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_String.raw.js
   cmd: runES6 :normal
 - path: es6/Proxy_internal_get_calls_ToPrimitive.js
 - path: es6/RegExp.prototype_properties_RegExp.prototype[Symbol.search].js
   cmd: runES6 :normal
 - path: es6/RegExp.prototype_properties_RegExp.prototype[Symbol.split].js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/RegExp.prototype_properties_RegExp[Symbol.species].js
   cmd: runES6 :normal
 - path: es6/RegExp_is_subclassable_correct_prototype_chain.js
 - path: es6/well-known_symbols_Symbol.species_existence.js
   cmd: runES6 :normal
 - path: es6/well-known_symbols_Symbol.species_RegExp.prototype[Symbol.split].js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/well-known_symbols_Symbol.split.js
-  cmd: runES6 :fail
+  cmd: runES6 :normal
 - path: es6/well-known_symbols_Symbol.toPrimitive.js
   cmd: runES6 :normal
 - path: es6/well-known_symbols_Symbol.toStringTag.js