Merge changes from topic "am-a59f7c6d-19e4-4e40-9cf9-2d2b7cb78ff4" into cw-f-dev

* changes:
  [automerger] [RESTRICT AUTOMERGE] Fix type confusion in libpac am: 16fdb895ce am: 3d52668937 am: 1af7ad8a36
  [automerger] [RESTRICT AUTOMERGE] Fix type confusion in libpac am: 16fdb895ce am: 3d52668937
  [automerger] [RESTRICT AUTOMERGE] Fix type confusion in libpac am: 16fdb895ce
  [RESTRICT AUTOMERGE] Fix type confusion in libpac

1 files changed, 12 insertions, 4 deletions

diff --git a/src/builtins/builtins-string.cc b/src/builtins/builtins-string.cc
index 7cef567c..04be7a3f 100644
--- a/src/builtins/builtins-string.cc
+++ b/src/builtins/builtins-string.cc
@@ -139,6 +139,7 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
   typedef std::function<Node*()> NodeFunction0;
   typedef std::function<Node*(Node* fn)> NodeFunction1;
   void MaybeCallFunctionAtSymbol(Node* const context, Node* const object,
+                                 Node* const maybe_string,
                                  Handle<Symbol> symbol,
                                  const NodeFunction0& regexp_call,
                                  const NodeFunction1& generic_call);
@@ -1189,8 +1190,9 @@ void StringBuiltinsAssembler::RequireObjectCoercible(Node* const context,
 }
 
 void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
-    Node* const context, Node* const object, Handle<Symbol> symbol,
-    const NodeFunction0& regexp_call, const NodeFunction1& generic_call) {
+    Node* const context, Node* const object, Node* const maybe_string,
+    Handle<Symbol> symbol, const NodeFunction0& regexp_call,
+    const NodeFunction1& generic_call) {
   Label out(this);
 
   // Smis definitely don't have an attached symbol.
@@ -1220,9 +1222,15 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
   }
 
   // Take the fast path for RegExps.
+  // There's two conditions: {object} needs to be a fast regexp, and
+  // {maybe_string} must be a string (we can't call ToString on the fast path
+  // since it may mutate {object}).
   {
     Label stub_call(this), slow_lookup(this);
 
+    GotoIf(TaggedIsSmi(maybe_string), &slow_lookup);
+    GotoIfNot(IsString(maybe_string), &slow_lookup);
+
     RegExpBuiltinsAssembler regexp_asm(state());
     regexp_asm.BranchIfFastRegExp(context, object, object_map, &stub_call,
                                   &slow_lookup);
@@ -1267,7 +1275,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   // Redirect to replacer method if {search[@@replace]} is not undefined.
 
   MaybeCallFunctionAtSymbol(
-      context, search, isolate()->factory()->replace_symbol(),
+      context, search, receiver, isolate()->factory()->replace_symbol(),
       [=]() {
         Callable tostring_callable = CodeFactory::ToString(isolate());
         Node* const subject_string =
@@ -1435,7 +1443,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   // Redirect to splitter method if {separator[@@split]} is not undefined.
 
   MaybeCallFunctionAtSymbol(
-      context, separator, isolate()->factory()->split_symbol(),
+      context, separator, receiver, isolate()->factory()->split_symbol(),
       [=]() {
         Callable tostring_callable = CodeFactory::ToString(isolate());
         Node* const subject_string =