[regexp] Add fast-path for global, callable replace

This adds a fast-path for calls to RegExp.prototype[@@replace] for cases in
which the given regexp is unmodified and global, and the given replace argument
is callable.

The fast-path implementation itself is almost identical to the original JS
implementation except that it currently does not reuse result_array.

SunSpider/unpack-code relies heavily on this codepath.

BUG=v8:5339

Review-Url: https://chromiumcodereview.appspot.com/2433923003
Cr-Commit-Position: refs/heads/master@{#40504}

src/compiler/code-assembler.cc

@@ -930,6 +930,24 @@ Node* CodeAssembler::CallJS(Callable const& callable, Node* context,
   return CallStubN(callable.descriptor(), argc + 1, target, args, result_size);
 }
 
+Node* CodeAssembler::CallJS(Callable const& callable, Node* context,
+                            Node* function, Node* receiver, Node* arg1,
+                            Node* arg2, Node* arg3, size_t result_size) {
+  const int argc = 3;
+  Node* target = HeapConstant(callable.code());
+
+  Node** args = zone()->NewArray<Node*>(argc + 4);
+  args[0] = function;
+  args[1] = Int32Constant(argc);
+  args[2] = receiver;
+  args[3] = arg1;
+  args[4] = arg2;
+  args[5] = arg3;
+  args[6] = context;
+
+  return CallStubN(callable.descriptor(), argc + 1, target, args, result_size);
+}
+
 Node* CodeAssembler::CallCFunction2(MachineType return_type,
                                     MachineType arg0_type,
                                     MachineType arg1_type, Node* function,

src/compiler/code-assembler.h

@@ -443,6 +443,9 @@ class V8_EXPORT_PRIVATE CodeAssembler {
                Node* receiver, Node* arg1, size_t result_size = 1);
   Node* CallJS(Callable const& callable, Node* context, Node* function,
                Node* receiver, Node* arg1, Node* arg2, size_t result_size = 1);
+  Node* CallJS(Callable const& callable, Node* context, Node* function,
+               Node* receiver, Node* arg1, Node* arg2, Node* arg3,
+               size_t result_size = 1);
 
   // Call to a C function with two arguments.
   Node* CallCFunction2(MachineType return_type, MachineType arg0_type,

src/runtime/runtime.h

@@ -461,6 +461,7 @@ namespace internal {
   F(RegExpConstructResult, 3, 1)                    \
   F(RegExpCreate, 1, 1)                             \
   F(RegExpExec, 4, 1)                               \
+  F(RegExpExecMultiple, 4, 1)                       \
   F(RegExpExecReThrow, 4, 1)                        \
   F(RegExpFlags, 1, 1)                              \
   F(RegExpInitializeAndCompile, 3, 1)               \
@@ -468,7 +469,6 @@ namespace internal {
   F(RegExpReplace, 3, 1)                            \
   F(RegExpSource, 1, 1)                             \
   F(StringReplaceGlobalRegExpWithString, 4, 1)      \
-  F(StringReplaceGlobalRegExpWithFunction, 3, 1)    \
   F(StringReplaceNonGlobalRegExpWithFunction, 3, 1) \
   F(StringSplit, 3, 1)
 

src/string-builder.h

@@ -174,6 +174,11 @@ class FixedArrayBuilder {
 
   int capacity() { return array_->length(); }
 
+  Handle<JSArray> ToJSArray(Handle<JSArray> target_array) {
+    JSArray::SetContent(target_array, array_);
+    target_array->set_length(Smi::FromInt(length_));
+    return target_array;
+  }
 
  private:
   Handle<FixedArray> array_;