1287525 - Missing property check before applying optimized RegExp.prototype[Symbol.split] code paths

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[André Bargull [:anba]]

Calling IsRegExp in step 1 of https://tc39.github.io/ecma262/#sec-regexp-pattern-flags could trigger side-effects.


Test case 1:
---
rx = /a/;
Object.defineProperty(rx, Symbol.match, {
  get() {
    print("OK");
  }
});
rx[Symbol.split]("abba");
---

Expected: Prints "OK"
Actual: "OK" not printed



Calling ToUint32(separator) can invalidate the fast-path assumptions in RegExp.prototype[Symbol.split].


Test case 2:
---
rx = /a/;
r = rx[Symbol.split]("abba", {valueOf() {
  RegExp.prototype.exec = () => null;
  return 100;
}});
print(r.length);
---

Expected: Prints "1"
Actual: Prints "3"

Comment 1

[Tooru Fujisawa [:arai]]

Attachment: Part 1: Do not use RegExp.prototype[@@split] optimized path if |this| object has extra property.

Added RegExpInstanceOptimizable call in IsRegExpSplitOptimizable, to check if |this| RegExp object has no extra property.
So that slow path is used when |this| has modified @@match getter.

Comment 2

[Tooru Fujisawa [:arai]]

Attachment: Part 2: Do not use RegExp.prototype[@@split] optimized path if limit is not number.

As ToInt32(limit) is performed *after* checking whether optimizable or not,
changed not to use optimized path if limit is neither undefined nor number.

Comment 3

[Tooru Fujisawa [:arai]]

bug 887016 was landed to firefox48, but backed out from firefox48 by bug 1265307, so this bug affects from firefox49.

Comment 4

[Hannes Verschore [:h4writer]]

Comment on attachment 8772230 [details] [diff] [review]
Part 1: Do not use RegExp.prototype[@@split] optimized path if |this| object has extra property.

Review of attachment 8772230 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay on these patches. Thanks!

Comment 5

[Tooru Fujisawa [:arai]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1b77ef6ac23ea2fc57246036dc7ae4dca98dbb19
Bug 1287525 - Part 1: Do not use RegExp.prototype[@@split] optimized path if |this| object has extra property. r=h4writer

https://hg.mozilla.org/integration/mozilla-inbound/rev/75976803569d9626c1ac5f495a69b0936321ed9e
Bug 1287525 - Part 2: Do not use RegExp.prototype[@@split] optimized path if limit is not number. r=h4writer

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1b77ef6ac23e
https://hg.mozilla.org/mozilla-central/rev/75976803569d