Bug 594108 - fix RegExp.exec()-to-RegExp.test() conversion. r=brendan.

js/src/jsatom.cpp

@@ -176,6 +176,7 @@ const char *const js_common_atom_names[] = {
     js_configurable_str,        /* configurableAtom             */
     js_writable_str,            /* writableAtom                 */
     js_value_str,               /* valueAtom                    */
+    js_test_str,                /* testAtom                     */
     "use strict",               /* useStrictAtom                */
 
 #if JS_HAS_XML_SUPPORT
@@ -265,6 +266,7 @@ const char js_enumerable_str[]      = "enumerable";
 const char js_configurable_str[]    = "configurable";
 const char js_writable_str[]        = "writable";
 const char js_value_str[]           = "value";
+const char js_test_str[]            = "test";
 
 #if JS_HAS_XML_SUPPORT
 const char js_etago_str[]           = "</";

js/src/jsatom.h

@@ -368,6 +368,7 @@ struct JSAtomState
     JSAtom              *configurableAtom;
     JSAtom              *writableAtom;
     JSAtom              *valueAtom;
+    JSAtom              *testAtom;
     JSAtom              *useStrictAtom;
 
 #if JS_HAS_XML_SUPPORT
@@ -524,6 +525,7 @@ extern const char   js_enumerable_str[];
 extern const char   js_configurable_str[];
 extern const char   js_writable_str[];
 extern const char   js_value_str[];
+extern const char   js_test_str[];
 
 /*
  * Initialize atom state. Return true on success, false on failure to allocate

js/src/jstracer.cpp

@@ -11148,7 +11148,8 @@ TraceRecorder::callNative(uintN argc, JSOp mode)
                  * - call / not / ifeq
                  * - call / trace / not / ifeq
                  *
-                 * In either case, we call RegExp.test() because "r.exec(s) !=
+                 * In either case, we replace the call to RegExp.exec() on the
+                 * stack with a call to RegExp.test() because "r.exec(s) !=
                  * null" is equivalent to "r.test(s)".  This avoids building
                  * the result array, which can be expensive.
                  */
@@ -11165,7 +11166,22 @@ TraceRecorder::callNative(uintN argc, JSOp mode)
                          pc[JSOP_CALL_LENGTH + JSOP_TRACE_LENGTH] == JSOP_NOT &&
                          pc[JSOP_CALL_LENGTH + JSOP_TRACE_LENGTH + JSOP_NOT_LENGTH] == JSOP_IFEQ))
                     {
-                        fun->u.n.native = js_regexp_test;
+                        /*
+                         * FIXME: Bug 594205 -- RegExp.prototype.test() may
+                         * have been overwritten.
+                         */
+                        JSObject* proto;
+                        Value test;
+                        jsid testId = ATOM_TO_JSID(cx->runtime->atomState.testAtom);
+                        if (js_GetClassPrototype(cx, funobj->getParent(), JSProto_RegExp, &proto) &&
+                            js_GetProperty(cx, proto, testId, &test))
+                        {
+                            vp[0] = test;
+                            /* Recompute these values from the new vp[0] value. */
+                            funobj = &vp[0].toObject();
+                            fun = GET_FUNCTION_PRIVATE(cx, funobj);
+                            native = fun->u.n.native;
+                        }
                     }
                 }
             }

js/src/trace-test/tests/basic/bug594108.js

@@ -0,0 +1,8 @@
+var res;
+for (var i = 0; i < 10; i++) {
+    var re = /a(b)c/;
+    var b = (re.exec(""), v = re.exec("abc")) !== null;
+    assertEq(v[0], "abc");
+    assertEq(v[1], "b");
+}
+