Revert of [regexp] Use consistent map checks for fast paths

src/runtime/runtime-regexp.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
@@ skipping 1482 matching lines @@
   DCHECK(args.length() == 3);
 
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, recv, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, string, 1);
   Handle<Object> replace_obj = args.at<Object>(2);
 
   Factory* factory = isolate->factory();
 
   string = String::Flatten(string);
 
-  // Fast-path for unmodified JSRegExps.
-  if (RegExpUtils::IsUnmodifiedRegExp(isolate, recv)) {
-    RETURN_RESULT_OR_FAILURE(
-        isolate, RegExpReplace(isolate, Handle<JSRegExp>::cast(recv), string,
-                               replace_obj));
-  }
-
   const int length = string->length();
   const bool functional_replace = replace_obj->IsCallable();
 
   Handle<String> replace;
   if (!functional_replace) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, replace,
                                        Object::ToString(isolate, replace_obj));
   }
 
   Handle<Object> global_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, global_obj,
       JSReceiver::GetProperty(recv, factory->global_string()));
   const bool global = global_obj->BooleanValue();
 
   bool unicode = false;
   if (global) {
     Handle<Object> unicode_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, unicode_obj,
         JSReceiver::GetProperty(recv, factory->unicode_string()));
     unicode = unicode_obj->BooleanValue();
 
     RETURN_FAILURE_ON_EXCEPTION(isolate,
                                 RegExpUtils::SetLastIndex(isolate, recv, 0));
   }
 
+  // TODO(jgruber): Here and at all other fast path checks, rely on map checks
+  // instead.
+  // TODO(jgruber): We could speed up the fast path by checking flags
+  // afterwards, but that would violate the spec (which states that exec is
+  // accessed after global and unicode).
+  // TODO(adamk): this fast path is wrong as we doesn't ensure that 'exec'
+  // is actually a data property on RegExp.prototype.
+  Handle<Object> exec = factory->undefined_value();
+  if (recv->IsJSRegExp()) {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, exec, JSObject::GetProperty(
+                           recv, factory->NewStringFromAsciiChecked("exec")));
+    if (RegExpUtils::IsBuiltinExec(exec)) {
+      RETURN_RESULT_OR_FAILURE(
+          isolate, RegExpReplace(isolate, Handle<JSRegExp>::cast(recv), string,
+                                 replace_obj));
+    }
+  }
+
   Zone zone(isolate->allocator(), ZONE_NAME);
   ZoneVector<Handle<Object>> results(&zone);
 
   while (true) {
     Handle<Object> result;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, result, RegExpUtils::RegExpExec(isolate, recv, string,
-                                                 factory->undefined_value()));
+        isolate, result, RegExpUtils::RegExpExec(isolate, recv, string, exec));
+
+    // Ensure exec will be read again on the next loop through.
+    exec = factory->undefined_value();
 
     if (result->IsNull(isolate)) break;
 
     results.push_back(result);
     if (!global) break;
 
     Handle<Object> match_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, match_obj,
                                        Object::GetElement(isolate, result, 0));
 
@@ skipping 112 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_IsRegExp) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 1);
   CONVERT_ARG_CHECKED(Object, obj, 0);
   return isolate->heap()->ToBoolean(obj->IsJSRegExp());
 }
 
 }  // namespace internal
 }  // namespace v8