• Jakob Gruber's avatar
    [regexp] Pass correct limit to Runtime::kRegExpSplit · c7a7bf6a
    Jakob Gruber authored
    The Uint32(limit) conversion can end up transitioning the regexp
    instance to slow mode. In this case we need to bail out to runtime while
    ensuring that ToUint32 is not observably called a second time. We do
    this by passing the already-converted value to runtime.
    
    This particular path was broken and we ended up passing the original
    maybe_limit value to runtime instead.
    
    TBR=yangguo@chromium.org
    
    Bug: chromium:758763
    Change-Id: If7f23b452d2e134ad9be3d4ef1d78d1c946fcef0
    Reviewed-on: https://chromium-review.googlesource.com/635588Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
    Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#47609}
    c7a7bf6a
regress-758763.js 277 Bytes