[regexp] Use SameValue in @@search as specced

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2452923002
Cr-Commit-Position: refs/heads/master@{#40634}

src/builtins/builtins-regexp.cc

@@ -1158,8 +1158,7 @@ BUILTIN(RegExpPrototypeSearch) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, previous_last_index_obj,
                                      RegExpUtils::GetLastIndex(isolate, recv));
 
-  if (!previous_last_index_obj->IsSmi() ||
-      Smi::cast(*previous_last_index_obj)->value() != 0) {
+  if (!previous_last_index_obj->SameValue(Smi::kZero)) {
     RETURN_FAILURE_ON_EXCEPTION(isolate,
                                 RegExpUtils::SetLastIndex(isolate, recv, 0));
   }
@@ -1174,10 +1173,9 @@ BUILTIN(RegExpPrototypeSearch) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, current_last_index_obj,
                                      RegExpUtils::GetLastIndex(isolate, recv));
 
-  Maybe<bool> is_last_index_unchanged =
-      Object::Equals(current_last_index_obj, previous_last_index_obj);
-  if (is_last_index_unchanged.IsNothing()) return isolate->pending_exception();
-  if (!is_last_index_unchanged.FromJust()) {
+  const bool is_last_index_unchanged =
+      current_last_index_obj->SameValue(*previous_last_index_obj);
+  if (!is_last_index_unchanged) {
     if (previous_last_index_obj->IsSmi()) {
       RETURN_FAILURE_ON_EXCEPTION(
           isolate,

test/mjsunit/regexp.js

@@ -739,3 +739,11 @@ const RegExpPrototypeExec = RegExp.prototype.exec;
 RegExp.prototype.exec = function() { throw new Error(); }
 assertThrows(() => "abc".replace(/./, ""));
 RegExp.prototype.exec = RegExpPrototypeExec;
+
+// Test the code path in RE.proto[@@search] when previousLastIndex is a receiver
+// but can't be converted to a primitive. This exposed a crash in the
+// C++ implementation of @@search.
+
+var re = /./;
+re.lastIndex = { [Symbol.toPrimitive]: 42 };
+() => "abc".search(re);