Base the right RegExp brand checks on Symbol.match

The ES2015 specification requires that String.prototype.startsWith,
String.prototype.endsWith and String.prototype.includes use the IsRegExp
internal algorithm to determine whether to throw a TypeError to prevent
a RegExp from being accidentally cast to a String for those methods.
That internal algorithm checks the presence/truthiness of Symbol.match
to make its determination. This patch switches the builtins to use
this correct test, rather than checking for the [[RegExpMatcher]]
internal slot as the builtins previously did.

R=yangguo

Review URL: https://codereview.chromium.org/1762183002

Cr-Commit-Position: refs/heads/master@{#34547}

src/js/regexp.js

@@ -776,6 +776,7 @@ utils.Export(function(to) {
   to.RegExpExecNoTests = RegExpExecNoTests;
   to.RegExpLastMatchInfo = RegExpLastMatchInfo;
   to.RegExpTest = RegExpTest;
+  to.IsRegExp = IsRegExp;
 });
 
 })

src/js/string.js

@@ -15,6 +15,7 @@ var GlobalRegExp = global.RegExp;
 var GlobalString = global.String;
 var InternalArray = utils.InternalArray;
 var InternalPackedArray = utils.InternalPackedArray;
+var IsRegExp;
 var MakeRangeError;
 var MakeTypeError;
 var MaxSimple;
@@ -28,6 +29,7 @@ var splitSymbol = utils.ImportNow("split_symbol");
 utils.Import(function(from) {
   ArrayIndexOf = from.ArrayIndexOf;
   ArrayJoin = from.ArrayJoin;
+  IsRegExp = from.IsRegExp;
   MakeRangeError = from.MakeRangeError;
   MakeTypeError = from.MakeTypeError;
   MaxSimple = from.MaxSimple;
@@ -701,7 +703,7 @@ function StringStartsWith(searchString, position) {  // length == 1
 
   var s = TO_STRING(this);
 
-  if (IS_REGEXP(searchString)) {
+  if (IsRegExp(searchString)) {
     throw MakeTypeError(kFirstArgumentNotRegExp, "String.prototype.startsWith");
   }
 
@@ -727,7 +729,7 @@ function StringEndsWith(searchString, position) {  // length == 1
 
   var s = TO_STRING(this);
 
-  if (IS_REGEXP(searchString)) {
+  if (IsRegExp(searchString)) {
     throw MakeTypeError(kFirstArgumentNotRegExp, "String.prototype.endsWith");
   }
 
@@ -754,7 +756,7 @@ function StringIncludes(searchString, position) {  // length == 1
 
   var string = TO_STRING(this);
 
-  if (IS_REGEXP(searchString)) {
+  if (IsRegExp(searchString)) {
     throw MakeTypeError(kFirstArgumentNotRegExp, "String.prototype.includes");
   }
 

test/mjsunit/es6/string-endswith.js

@@ -408,3 +408,11 @@ assertThrows(function() {
     "toString": function() { return "abc"; }
   }, [/./]);
 }, TypeError);
+
+// endsWith does its brand checks with Symbol.match
+var re = /./;
+assertThrows(function() {
+  "".startsWith(re);
+}, TypeError);
+re[Symbol.match] = false;
+assertEquals(false, "".startsWith(re));

test/mjsunit/es6/string-includes.js

@@ -162,3 +162,11 @@ assertThrows("String.prototype.includes.apply({ 'toString': function() { " +
   "throw RangeError(); } }, [/./])", RangeError);
 assertThrows("String.prototype.includes.apply({ 'toString': function() { " +
   "return 'abc'; } }, [/./])", TypeError);
+
+// includes does its brand checks with Symbol.match
+var re = /./;
+assertThrows(function() {
+  "".includes(re);
+}, TypeError);
+re[Symbol.match] = false;
+assertEquals(false, "".includes(re));

test/mjsunit/es6/string-startswith.js

@@ -399,3 +399,11 @@ assertThrows(function() {
     "toString": function() { return "abc"; }
   }, [/./]);
 }, TypeError);
+
+// startsWith does its brand checks with Symbol.match
+var re = /./;
+assertThrows(function() {
+  "".startsWith(re);
+}, TypeError);
+re[Symbol.match] = false;
+assertEquals(false, "".startsWith(re));

test/test262/test262.status

@@ -142,9 +142,6 @@
   # happens to be thrown for some other reason (e.g,
   # built-ins/RegExp/prototype/Symbol.match/builtin-failure-set-lastindex-err)
   'built-ins/RegExp/prototype/Symbol.match/*': [SKIP],
-  'built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test': [FAIL],
-  'built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test': [FAIL],
-  'built-ins/String/prototype/startsWith/return-abrupt-from-searchstring-regexp-test': [FAIL],
   'built-ins/String/prototype/match/invoke-builtin-match': [FAIL],
 
   # https://code.google.com/p/v8/issues/detail?id=4343