String.prototype.{match,search} should do only one RegExp brand check

Previously, they would check for Symbol.match/Symbol.search, and then
do another check for Symbol.match in the RegExp constructor. This patch
avoids the second one by skipping the RegExp constructor, as the spec does.

Review URL: https://codereview.chromium.org/1840723002

Cr-Commit-Position: refs/heads/master@{#35085}

src/js/regexp.js

@@ -1183,6 +1183,7 @@ for (var i = 1; i < 10; ++i) {
 
 utils.Export(function(to) {
   to.RegExpExec = DoRegExpExec;
+  to.RegExpInitialize = RegExpInitialize;
   to.RegExpLastMatchInfo = RegExpLastMatchInfo;
   to.RegExpSubclassExecJS = RegExpSubclassExecJS;
   to.RegExpSubclassMatch = RegExpSubclassMatch;

src/js/string.js

@@ -20,6 +20,7 @@ var MakeRangeError;
 var MakeTypeError;
 var MaxSimple;
 var MinSimple;
+var RegExpInitialize;
 var matchSymbol = utils.ImportNow("match_symbol");
 var replaceSymbol = utils.ImportNow("replace_symbol");
 var searchSymbol = utils.ImportNow("search_symbol");
@@ -33,6 +34,7 @@ utils.Import(function(from) {
   MakeTypeError = from.MakeTypeError;
   MaxSimple = from.MaxSimple;
   MinSimple = from.MinSimple;
+  RegExpInitialize = from.RegExpInitialize;
 });
 
 //-------------------------------------------------------------------
@@ -159,8 +161,9 @@ function StringMatchJS(pattern) {
 
   var subject = TO_STRING(this);
 
-  // Non-regexp argument.
-  var regexp = new GlobalRegExp(pattern);
+  // Equivalent to RegExpCreate (ES#sec-regexpcreate)
+  var regexp = %NewObject(GlobalRegExp, GlobalRegExp);
+  RegExpInitialize(regexp, pattern);
   return regexp[matchSymbol](subject);
 }
 
@@ -355,7 +358,10 @@ function StringSearch(pattern) {
   }
 
   var subject = TO_STRING(this);
-  var regexp = new GlobalRegExp(pattern);
+
+  // Equivalent to RegExpCreate (ES#sec-regexpcreate)
+  var regexp = %NewObject(GlobalRegExp, GlobalRegExp);
+  RegExpInitialize(regexp, pattern);
   return %_Call(regexp[searchSymbol], regexp, subject);
 }
 

test/mjsunit/es6/pattern-brand-check.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-subclass
+
+function createNonRegExp(calls) {
+  return {
+    get [Symbol.match]() {
+      calls.push("@@match");
+      return undefined;
+    },
+    get [Symbol.replace]() {
+      calls.push("@@replace");
+      return undefined;
+    },
+    get [Symbol.search]() {
+      calls.push("@@search");
+      return undefined;
+    },
+    get [Symbol.split]() {
+      calls.push("@@split");
+      return undefined;
+    },
+    [Symbol.toPrimitive]() {
+      calls.push("@@toPrimitive");
+      return "";
+    }
+  };
+}
+
+(function testStringMatchBrandCheck() {
+  var calls = [];
+  "".match(createNonRegExp(calls));
+  assertEquals(["@@match", "@@toPrimitive"], calls);
+})();
+
+(function testStringSearchBrandCheck() {
+  var calls = [];
+  "".search(createNonRegExp(calls));
+  assertEquals(["@@search", "@@toPrimitive"], calls);
+})();
+
+(function testStringSplitBrandCheck() {
+  var calls = [];
+  "".split(createNonRegExp(calls));
+  assertEquals(["@@split", "@@toPrimitive"], calls);
+})();
+
+(function testStringReplaceBrandCheck() {
+  var calls = [];
+  "".replace(createNonRegExp(calls), "");
+  assertEquals(["@@replace", "@@toPrimitive"], calls);
+})();