In RegExp, lastIndex is read with ToLength, not ToInteger

ES2015 made a change vs ES5, where the "lastIndex" property of a
RegExp (which can be modified by a user to start the next search at
a different location) is cast to an integer with ToLength rather
than ToInteger. The main difference is on negative numbers, and
this is tested by test262. This patch implements that change on
RegExps and enables the test262 test now that it passes.

R=adamk
LOG=Y
BUG=v8:4244

Review URL: https://codereview.chromium.org/1241713004

Cr-Commit-Position: refs/heads/master@{#29715}

src/regexp.js

@@ -154,9 +154,9 @@ function RegExpExecJS(string) {
   string = TO_STRING_INLINE(string);
   var lastIndex = this.lastIndex;
 
-  // Conversion is required by the ES5 specification (RegExp.prototype.exec
-  // algorithm, step 5) even if the value is discarded for non-global RegExps.
-  var i = TO_INTEGER(lastIndex);
+  // Conversion is required by the ES6 specification (RegExpBuiltinExec
+  // algorithm, step 4) even if the value is discarded for non-global RegExps.
+  var i = $toLength(lastIndex);
 
   var updateLastIndex = this.global || (harmony_regexps && this.sticky);
   if (updateLastIndex) {
@@ -202,9 +202,9 @@ function RegExpTest(string) {
 
   var lastIndex = this.lastIndex;
 
-  // Conversion is required by the ES5 specification (RegExp.prototype.exec
-  // algorithm, step 5) even if the value is discarded for non-global RegExps.
-  var i = TO_INTEGER(lastIndex);
+  // Conversion is required by the ES6 specification (RegExpBuiltinExec
+  // algorithm, step 4) even if the value is discarded for non-global RegExps.
+  var i = $toLength(lastIndex);
 
   if (this.global || (harmony_regexps && this.sticky)) {
     if (i < 0 || i > string.length) {

test/mozilla/mozilla.status

@@ -85,6 +85,8 @@
   'ecma/String/15.5.4.8-1': [FAIL],
   'ecma/String/15.5.4.9-1': [FAIL],
 
+  # ToLength, not ToUint32, is called on RegExps' lastIndex property
+  'ecma_3/RegExp/15.10.6.2-2': [FAIL],
 
   ##################### SKIPPED TESTS #####################
 

test/test262-es6/test262-es6.status

@@ -421,9 +421,6 @@
   # https://code.google.com/p/v8/issues/detail?id=4003
   'built-ins/RegExp/prototype/15.10.6': [FAIL],
 
-  # https://code.google.com/p/v8/issues/detail?id=4244
-  'built-ins/RegExp/prototype/exec/S15.10.6.2_A5_T3': [FAIL],
-
   # https://code.google.com/p/v8/issues/detail?id=4006
   'built-ins/String/prototype/S15.5.4_A1': [FAIL],
   'built-ins/String/prototype/S15.5.4_A2': [FAIL],

test/test262/test262.status

@@ -281,6 +281,9 @@
   '15.2.3.13-1-3': [FAIL],
   '15.2.3.13-1-4': [FAIL],
 
+  # ES6 RegExp test calls ToLength, not ToUint32
+  'S15.10.6.2_A5_T3': [FAIL],
+
   ######################## NEEDS INVESTIGATION ###########################
 
   # These test failures are specific to the intl402 suite and need investigation