Do not coerce lastIndex of a global RegExp in @@match and @@replace.

R=rossberg@chromium.org
BUG=v8:4471
LOG=N

Review URL: https://codereview.chromium.org/1410753002

Cr-Commit-Position: refs/heads/master@{#31330}

src/js/string.js

@@ -151,9 +151,6 @@ function StringMatchJS(regexp) {
 
   var subject = TO_STRING(this);
   if (IS_REGEXP(regexp)) {
-    // Emulate RegExp.prototype.exec's side effect in step 5, even though
-    // value is discarded.
-    var lastIndex = TO_INTEGER(regexp.lastIndex);
     if (!regexp.global) return RegExpExecNoTests(regexp, subject, 0);
     var result = %StringMatch(subject, regexp, RegExpLastMatchInfo);
     if (result !== null) $regexpLastMatchInfoOverride = null;
@@ -222,10 +219,6 @@ function StringReplace(search, replace) {
   // ...... string replace (with $-expansion)
 
   if (IS_REGEXP(search)) {
-    // Emulate RegExp.prototype.exec's side effect in step 5, even if
-    // value is discarded.
-    var lastIndex = TO_INTEGER(search.lastIndex);
-
     if (!IS_CALLABLE(replace)) {
       replace = TO_STRING(replace);
 

test/mjsunit/es6/regexp-match-lastindex.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests that lastIndex of a global RegExp is overwritten as per
+// ECMA-262 6.0 21.2.5.6 step 8.c.
+
+var global = /./g;
+global.lastIndex = { valueOf: function() { assertUnreachable(); } };
+"x".match(global);
+assertEquals(0, global.lastIndex);

test/mjsunit/es6/regexp-replace-lastindex.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests that lastIndex of a global RegExp is overwritten as per
+// ECMA-262 6.0 21.2.5.8 step 10.c.
+
+var global = /./g;
+global.lastIndex = { valueOf: function() { assertUnreachable(); } };
+assertEquals("X", "x".replace(global, function(a) { return "X"; }));
+assertEquals(0, global.lastIndex);

test/mjsunit/regress/regress-2438.js

@@ -35,14 +35,6 @@ function testSideEffects(subject, re) {
   re.lastIndex = side_effect_object;
   re.test(subject);
   assertEquals(2, counter);
-
-  re.lastIndex = side_effect_object;
-  subject.match(re);
-  assertEquals(3, counter);
-
-  re.lastIndex = side_effect_object;
-  subject.replace(re, "");
-  assertEquals(4, counter);
 }
 
 testSideEffects("zzzz", /a/);