Use in-object fields instead of private symbols for regexp slots.

R=bmeurer@chromium.org

Committed: https://crrev.com/5a1e42c039ac3379ebe1e7e34fb8163e1ec1493e
Cr-Commit-Position: refs/heads/master@{#31791}

Review URL: https://codereview.chromium.org/1428203003

Cr-Commit-Position: refs/heads/master@{#31805}

src/bootstrapper.cc

@@ -1223,32 +1223,15 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     DCHECK_EQ(0, initial_map->GetInObjectProperties());
 
-    PropertyAttributes final =
-        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-    Map::EnsureDescriptorSlack(initial_map, 5);
+    Map::EnsureDescriptorSlack(initial_map, 1);
 
-    {
-      // ES6 21.2.3.2.1
-      DataDescriptor field(factory->regexp_source_symbol(),
-                           JSRegExp::kSourceFieldIndex, final,
-                           Representation::Tagged());
-      initial_map->AppendDescriptor(&field);
-    }
-    {
-      DataDescriptor field(factory->regexp_flags_symbol(),
-                           JSRegExp::kFlagsFieldIndex, final,
-                           Representation::Smi());
-      initial_map->AppendDescriptor(&field);
-    }
-    {
-      // ECMA-262, section 15.10.7.5.
-      PropertyAttributes writable =
-          static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
-      DataDescriptor field(factory->last_index_string(),
-                           JSRegExp::kLastIndexFieldIndex, writable,
-                           Representation::Tagged());
-      initial_map->AppendDescriptor(&field);
-    }
+    // ECMA-262, section 15.10.7.5.
+    PropertyAttributes writable =
+        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
+    DataDescriptor field(factory->last_index_string(),
+                         JSRegExp::kLastIndexFieldIndex, writable,
+                         Representation::Tagged());
+    initial_map->AppendDescriptor(&field);
 
     static const int num_fields = JSRegExp::kInObjectFieldCount;
     initial_map->SetInObjectProperties(num_fields);

src/crankshaft/hydrogen-instructions.h

@@ -6195,6 +6195,14 @@ class HObjectAccess final {
     return HObjectAccess(kInobject, JSGlobalObject::kNativeContextOffset);
   }
 
+  static HObjectAccess ForJSRegExpFlags() {
+    return HObjectAccess(kInobject, JSRegExp::kFlagsOffset);
+  }
+
+  static HObjectAccess ForJSRegExpSource() {
+    return HObjectAccess(kInobject, JSRegExp::kSourceOffset);
+  }
+
   static HObjectAccess ForJSCollectionTable() {
     return HObjectAccess::ForObservableJSObjectOffset(
         JSCollection::kTableOffset);

src/crankshaft/hydrogen.cc

@@ -12644,6 +12644,26 @@ void HOptimizedGraphBuilder::GenerateRegExpExec(CallRuntime* call) {
 }
 
 
+void HOptimizedGraphBuilder::GenerateRegExpFlags(CallRuntime* call) {
+  DCHECK_EQ(1, call->arguments()->length());
+  CHECK_ALIVE(VisitExpressions(call->arguments()));
+  HValue* regexp = Pop();
+  HInstruction* result =
+      New<HLoadNamedField>(regexp, nullptr, HObjectAccess::ForJSRegExpFlags());
+  return ast_context()->ReturnInstruction(result, call->id());
+}
+
+
+void HOptimizedGraphBuilder::GenerateRegExpSource(CallRuntime* call) {
+  DCHECK_EQ(1, call->arguments()->length());
+  CHECK_ALIVE(VisitExpressions(call->arguments()));
+  HValue* regexp = Pop();
+  HInstruction* result =
+      New<HLoadNamedField>(regexp, nullptr, HObjectAccess::ForJSRegExpSource());
+  return ast_context()->ReturnInstruction(result, call->id());
+}
+
+
 void HOptimizedGraphBuilder::GenerateDoubleLo(CallRuntime* call) {
   DCHECK_EQ(1, call->arguments()->length());
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));

src/crankshaft/hydrogen.h

@@ -2235,6 +2235,8 @@ class HOptimizedGraphBuilder : public HGraphBuilder, public AstVisitor {
   F(SubString)                         \
   F(RegExpExec)                        \
   F(RegExpConstructResult)             \
+  F(RegExpFlags)                       \
+  F(RegExpSource)                      \
   F(NumberToString)                    \
   F(DebugIsActive)                     \
   F(Likely)                            \

src/js/macros.py

@@ -185,12 +185,12 @@ define REGEXP_MULTILINE_MASK = 4;
 define REGEXP_STICKY_MASK = 8;
 define REGEXP_UNICODE_MASK = 16;
 
-macro REGEXP_GLOBAL(regexp) = (regexp[regExpFlagsSymbol] & REGEXP_GLOBAL_MASK);
-macro REGEXP_IGNORE_CASE(regexp) = (regexp[regExpFlagsSymbol] & REGEXP_IGNORE_CASE_MASK);
-macro REGEXP_MULTILINE(regexp) = (regexp[regExpFlagsSymbol] & REGEXP_MULTILINE_MASK);
-macro REGEXP_STICKY(regexp) = (regexp[regExpFlagsSymbol] & REGEXP_STICKY_MASK);
-macro REGEXP_UNICODE(regexp) = (regexp[regExpFlagsSymbol] & REGEXP_UNICODE_MASK);
-macro REGEXP_SOURCE(regexp) = (regexp[regExpSourceSymbol]);
+macro REGEXP_GLOBAL(regexp) = (%_RegExpFlags(regexp) & REGEXP_GLOBAL_MASK);
+macro REGEXP_IGNORE_CASE(regexp) = (%_RegExpFlags(regexp) & REGEXP_IGNORE_CASE_MASK);
+macro REGEXP_MULTILINE(regexp) = (%_RegExpFlags(regexp) & REGEXP_MULTILINE_MASK);
+macro REGEXP_STICKY(regexp) = (%_RegExpFlags(regexp) & REGEXP_STICKY_MASK);
+macro REGEXP_UNICODE(regexp) = (%_RegExpFlags(regexp) & REGEXP_UNICODE_MASK);
+macro REGEXP_SOURCE(regexp) = (%_RegExpSource(regexp));
 
 # We can't put macros in macros so we use constants here.
 # REGEXP_NUMBER_OF_CAPTURES

src/js/regexp.js

@@ -14,8 +14,6 @@ var GlobalObject = global.Object;
 var GlobalRegExp = global.RegExp;
 var InternalPackedArray = utils.InternalPackedArray;
 var MakeTypeError;
-var regExpFlagsSymbol = utils.ImportNow("regexp_flags_symbol");
-var regExpSourceSymbol = utils.ImportNow("regexp_source_symbol");
 
 utils.ImportFromExperimental(function(from) {
   FLAG_harmony_tolength = from.FLAG_harmony_tolength;
@@ -334,14 +332,10 @@ function RegExpMakeCaptureGetter(n) {
 // ES6 21.2.5.4, 21.2.5.5, 21.2.5.7, 21.2.5.12, 21.2.5.15.
 function GetRegExpFlagGetter(name, mask) {
   var getter = function() {
-    if (!IS_SPEC_OBJECT(this)) {
+    if (!IS_REGEXP(this)) {
       throw MakeTypeError(kRegExpNonObject, name, TO_STRING(this));
     }
-    var flags = this[regExpFlagsSymbol];
-    if (IS_UNDEFINED(flags)) {
-      throw MakeTypeError(kRegExpNonRegExp, TO_STRING(this));
-    }
-    return !!(flags & mask);
+    return !!(%_RegExpFlags(this) & mask);
   };
   %FunctionSetName(getter, name);
   %SetNativeFlag(getter);
@@ -351,15 +345,11 @@ function GetRegExpFlagGetter(name, mask) {
 
 // ES6 21.2.5.10.
 function RegExpGetSource() {
-  if (!IS_SPEC_OBJECT(this)) {
+  if (!IS_REGEXP(this)) {
     throw MakeTypeError(kRegExpNonObject, "RegExp.prototype.source",
                         TO_STRING(this));
   }
-  var source = this[regExpSourceSymbol];
-  if (IS_UNDEFINED(source)) {
-    throw MakeTypeError(kRegExpNonRegExp, TO_STRING(this));
-  }
-  return source;
+  return %_RegExpSource(this);
 }
 
 %SetNativeFlag(RegExpGetSource);

src/js/string.js

@@ -19,7 +19,6 @@ var MakeRangeError;
 var MakeTypeError;
 var RegExpExec;
 var RegExpExecNoTests;
-var regExpFlagsSymbol = utils.ImportNow("regexp_flags_symbol");
 var RegExpLastMatchInfo;
 
 utils.Import(function(from) {

src/objects-inl.h

@@ -6772,6 +6772,8 @@ ACCESSORS(JSTypedArray, raw_length, Object, kLengthOffset)
 
 
 ACCESSORS(JSRegExp, data, Object, kDataOffset)
+ACCESSORS(JSRegExp, flags, Object, kFlagsOffset)
+ACCESSORS(JSRegExp, source, Object, kSourceOffset)
 
 
 JSRegExp::Type JSRegExp::TypeTag() {

src/objects.h

@@ -7699,6 +7699,8 @@ class JSRegExp: public JSObject {
   };
 
   DECL_ACCESSORS(data, Object)
+  DECL_ACCESSORS(flags, Object)
+  DECL_ACCESSORS(source, Object)
 
   inline Type TypeTag();
   inline int CaptureCount();
@@ -7731,7 +7733,9 @@ class JSRegExp: public JSObject {
   DECLARE_VERIFIER(JSRegExp)
 
   static const int kDataOffset = JSObject::kHeaderSize;
-  static const int kSize = kDataOffset + kPointerSize;
+  static const int kSourceOffset = kDataOffset + kPointerSize;
+  static const int kFlagsOffset = kSourceOffset + kPointerSize;
+  static const int kSize = kFlagsOffset + kPointerSize;
 
   // Indices in the data array.
   static const int kTagIndex = 0;
@@ -7780,10 +7784,8 @@ class JSRegExp: public JSObject {
       FixedArray::kHeaderSize + kIrregexpCaptureCountIndex * kPointerSize;
 
   // In-object fields.
-  static const int kSourceFieldIndex = 0;
-  static const int kFlagsFieldIndex = 1;
-  static const int kLastIndexFieldIndex = 2;
-  static const int kInObjectFieldCount = 3;
+  static const int kLastIndexFieldIndex = 0;
+  static const int kInObjectFieldCount = 1;
 
   // The uninitialized value for a regexp code object.
   static const int kUninitializedValue = -1;

src/runtime/runtime-regexp.cc

@@ -788,6 +788,22 @@ RUNTIME_FUNCTION(Runtime_RegExpExec) {
 }
 
 
+RUNTIME_FUNCTION(Runtime_RegExpFlags) {
+  SealHandleScope shs(isolate);
+  DCHECK(args.length() == 1);
+  CONVERT_ARG_CHECKED(JSRegExp, regexp, 0);
+  return regexp->flags();
+}
+
+
+RUNTIME_FUNCTION(Runtime_RegExpSource) {
+  SealHandleScope shs(isolate);
+  DCHECK(args.length() == 1);
+  CONVERT_ARG_CHECKED(JSRegExp, regexp, 0);
+  return regexp->source();
+}
+
+
 RUNTIME_FUNCTION(Runtime_RegExpConstructResult) {
   HandleScope handle_scope(isolate);
   DCHECK(args.length() == 3);
@@ -924,37 +940,24 @@ RUNTIME_FUNCTION(Runtime_RegExpInitializeAndCompile) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, escaped_source,
                                      EscapeRegExpSource(isolate, source));
 
+  regexp->set_source(*escaped_source);
+  regexp->set_flags(Smi::FromInt(flags.value()));
+
   Map* map = regexp->map();
   Object* constructor = map->GetConstructor();
   if (constructor->IsJSFunction() &&
       JSFunction::cast(constructor)->initial_map() == map) {
     // If we still have the original map, set in-object properties directly.
-    regexp->InObjectPropertyAtPut(JSRegExp::kSourceFieldIndex, *escaped_source);
-    regexp->InObjectPropertyAtPut(JSRegExp::kFlagsFieldIndex,
-                                  Smi::FromInt(flags.value()),
-                                  SKIP_WRITE_BARRIER);
     regexp->InObjectPropertyAtPut(JSRegExp::kLastIndexFieldIndex,
                                   Smi::FromInt(0), SKIP_WRITE_BARRIER);
   } else {
-    // Map has changed, so use generic, but slower, method.  We also end here if
-    // the --harmony-regexp flag is set, because the initial map does not have
-    // space for the 'sticky' flag, since it is from the snapshot, but must work
-    // both with and without --harmony-regexp.  When sticky comes out from under
-    // the flag, we will be able to use the fast initial map.
-    PropertyAttributes final =
-        static_cast<PropertyAttributes>(READ_ONLY | DONT_ENUM | DONT_DELETE);
+    // Map has changed, so use generic, but slower, method.
     PropertyAttributes writable =
         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
-    Handle<Object> zero(Smi::FromInt(0), isolate);
     JSObject::SetOwnPropertyIgnoreAttributes(
-        regexp, factory->regexp_source_symbol(), escaped_source, final)
+        regexp, factory->last_index_string(),
+        Handle<Smi>(Smi::FromInt(0), isolate), writable)
         .Check();
-    JSObject::SetOwnPropertyIgnoreAttributes(
-        regexp, factory->regexp_flags_symbol(),
-        Handle<Smi>(Smi::FromInt(flags.value()), isolate), final)
-        .Check();
-    JSObject::SetOwnPropertyIgnoreAttributes(
-        regexp, factory->last_index_string(), zero, writable).Check();
   }
 
   Handle<Object> result;

src/runtime/runtime.h

@@ -559,6 +559,8 @@ namespace internal {
   F(StringReplaceGlobalRegExpWithString, 4, 1) \
   F(StringSplit, 3, 1)                         \
   F(RegExpExec, 4, 1)                          \
+  F(RegExpFlags, 1, 1)                         \
+  F(RegExpSource, 1, 1)                        \
   F(RegExpConstructResult, 3, 1)               \
   F(RegExpInitializeAndCompile, 3, 1)          \
   F(MaterializeRegExpLiteral, 4, 1)            \