2015-11-02  Keith Miller  <keith_miller@apple.com>

        [ES6] Add support for Symbol.replace.

        https://bugs.webkit.org/show_bug.cgi?id=150812

        Reviewed by NOBODY (OOPS!).

        This patch adds support for Symbol.replace. This patch changes

        String.prototype.replace so it now calls the Symbol.replace property

        on the first argument. The underlying behavior for both a string

        first argument and a non-string first argument remains unchanged.

        In a future patch we need to update the code to reflectthe ES6 spec.

        Finally, most of the replace helper code has been moved to

        RegExpPrototype.cpp; partly, because the code was no longer relevent

        but also because some of the code is shared but inherently tied to

        regular expressions.

        * runtime/CommonIdentifiers.h:

        * runtime/JSGlobalObject.cpp:

        (JSC::JSGlobalObject::init):

        * runtime/RegExpPrototype.cpp:

        (JSC::RegExpPrototype::finishCreation):

        (JSC::StringRange::StringRange):

        (JSC::substituteBackreferencesSlow):

        (JSC::jsSpliceSubstrings):

        (JSC::jsSpliceSubstringsWithSeparators):

        (JSC::removeUsingRegExpSearch):

        (JSC::regExpProtoFuncReplaceSymbol):

        * runtime/RegExpPrototype.h:

        (JSC::RegExpPrototype::create):

        (JSC::substituteBackreferences):

        * runtime/StringPrototype.cpp:

        (JSC::replaceUsingStringSearch):

        (JSC::stringProtoFuncReplace):

        (JSC::substituteBackreferencesSlow): Deleted.

        (JSC::substituteBackreferences): Deleted.

        (JSC::StringRange::StringRange): Deleted.

        (JSC::jsSpliceSubstrings): Deleted.

        (JSC::jsSpliceSubstringsWithSeparators): Deleted.

        (JSC::removeUsingRegExpSearch): Deleted.

        (JSC::replaceUsingRegExpSearch): Deleted.

        * tests/es6.yaml:

#include "CachedCall.h"

#include "RegExpConstructor.h"

static EncodedJSValue JSC_HOST_CALL regExpProtoFuncReplaceSymbol(ExecState*);

void RegExpPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)

{

    Base::finishCreation(vm);

    JSC_NATIVE_FUNCTION(vm.propertyNames->replaceSymbol, regExpProtoFuncReplaceSymbol, DontEnum | DontDelete | ReadOnly, 2);

}

struct StringRange {

    StringRange(int pos, int len)

        : position(pos)

        , length(len)

    {

    }

    StringRange()

    {

    }

    int position;

    int length;

};

String substituteBackreferencesSlow(StringView replacement, StringView source, const int* ovector, RegExp* reg, size_t i)

{

    StringBuilder substitutedReplacement;

    int offset = 0;

    do {

        if (i + 1 == replacement.length())

            break;

        UChar ref = replacement[i + 1];

        if (ref == '$') {

            // "$$" -> "$"

            ++i;

            substitutedReplacement.append(replacement.substring(offset, i - offset));

            offset = i + 1;

            continue;

        }

        int backrefStart;

        int backrefLength;

        int advance = 0;

        if (ref == '&') {

            backrefStart = ovector[0];

            backrefLength = ovector[1] - backrefStart;

        } else if (ref == '`') {

            backrefStart = 0;

            backrefLength = ovector[0];

        } else if (ref == '\'') {

            backrefStart = ovector[1];

            backrefLength = source.length() - backrefStart;

        } else if (reg && ref >= '0' && ref <= '9') {

            // 1- and 2-digit back references are allowed

            unsigned backrefIndex = ref - '0';

            if (backrefIndex > reg->numSubpatterns())

                continue;

            if (replacement.length() > i + 2) {

                ref = replacement[i + 2];

                if (ref >= '0' && ref <= '9') {

                    backrefIndex = 10 * backrefIndex + ref - '0';

                    if (backrefIndex > reg->numSubpatterns())

                        backrefIndex = backrefIndex / 10; // Fall back to the 1-digit reference

                    else

                        advance = 1;

                }

            }

            if (!backrefIndex)

                continue;

            backrefStart = ovector[2 * backrefIndex];

            backrefLength = ovector[2 * backrefIndex + 1] - backrefStart;

        } else

            continue;

        if (i - offset)

            substitutedReplacement.append(replacement.substring(offset, i - offset));

        i += 1 + advance;

        offset = i + 1;

        if (backrefStart >= 0)

            substitutedReplacement.append(source.substring(backrefStart, backrefLength));

    } while ((i = replacement.find('$', i + 1)) != notFound);

    if (replacement.length() - offset)

        substitutedReplacement.append(replacement.substring(offset));

    return substitutedReplacement.toString();

}

static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount)

{

    if (rangeCount == 1) {

        int sourceSize = source.length();

        int position = substringRanges[0].position;

        int length = substringRanges[0].length;

        if (position <= 0 && length >= sourceSize)

            return sourceVal;

        // We could call String::substringSharingImpl(), but this would result in redundant checks.

        return jsString(exec, StringImpl::createSubstringSharingImpl(source.impl(), std::max(0, position), std::min(sourceSize, length)));

    }

    int totalLength = 0;

    for (int i = 0; i < rangeCount; i++)

        totalLength += substringRanges[i].length;

    if (!totalLength)

        return jsEmptyString(exec);

    if (source.is8Bit()) {

        LChar* buffer;

        const LChar* sourceData = source.characters8();

        RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength, buffer);

        if (!impl)

            return throwOutOfMemoryError(exec);

        int bufferPos = 0;

        for (int i = 0; i < rangeCount; i++) {

            if (int srcLen = substringRanges[i].length) {

                StringImpl::copyChars(buffer + bufferPos, sourceData + substringRanges[i].position, srcLen);

                bufferPos += srcLen;

            }

        }

        return jsString(exec, impl.release());

    }

    UChar* buffer;

    const UChar* sourceData = source.characters16();

    RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength, buffer);

    if (!impl)

        return throwOutOfMemoryError(exec);

    int bufferPos = 0;

    for (int i = 0; i < rangeCount; i++) {

        if (int srcLen = substringRanges[i].length) {

            StringImpl::copyChars(buffer + bufferPos, sourceData + substringRanges[i].position, srcLen);

            bufferPos += srcLen;

        }

    }

    return jsString(exec, impl.release());

}

static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount, const String* separators, int separatorCount)

{

    if (rangeCount == 1 && !separatorCount) {

        int sourceSize = source.length();

        int position = substringRanges[0].position;

        int length = substringRanges[0].length;

        if (position <= 0 && length >= sourceSize)

            return sourceVal;

        // We could call String::substringSharingImpl(), but this would result in redundant checks.

        return jsString(exec, StringImpl::createSubstringSharingImpl(source.impl(), std::max(0, position), std::min(sourceSize, length)));

    }

    Checked<int, RecordOverflow> totalLength = 0;

    bool allSeparators8Bit = true;

    for (int i = 0; i < rangeCount; i++)

        totalLength += substringRanges[i].length;

    for (int i = 0; i < separatorCount; i++) {

        totalLength += separators[i].length();

        if (separators[i].length() && !separators[i].is8Bit())

            allSeparators8Bit = false;

    }

    if (totalLength.hasOverflowed())

        return throwOutOfMemoryError(exec);

    if (!totalLength)

        return jsEmptyString(exec);

    if (source.is8Bit() && allSeparators8Bit) {

        LChar* buffer;

        const LChar* sourceData = source.characters8();

        RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);

        if (!impl)

            return throwOutOfMemoryError(exec);

        int maxCount = std::max(rangeCount, separatorCount);

        int bufferPos = 0;

        for (int i = 0; i < maxCount; i++) {

            if (i < rangeCount) {

                if (int srcLen = substringRanges[i].length) {

                    StringImpl::copyChars(buffer + bufferPos, sourceData + substringRanges[i].position, srcLen);

                    bufferPos += srcLen;

                }

            }

            if (i < separatorCount) {

                if (int sepLen = separators[i].length()) {

                    StringImpl::copyChars(buffer + bufferPos, separators[i].characters8(), sepLen);

                    bufferPos += sepLen;

                }

            }

        }

        return jsString(exec, impl.release());

    }

    UChar* buffer;

    RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);

    if (!impl)

        return throwOutOfMemoryError(exec);

    int maxCount = std::max(rangeCount, separatorCount);

    int bufferPos = 0;

    for (int i = 0; i < maxCount; i++) {

        if (i < rangeCount) {

            if (int srcLen = substringRanges[i].length) {

                if (source.is8Bit())

                    StringImpl::copyChars(buffer + bufferPos, source.characters8() + substringRanges[i].position, srcLen);

                else

                    StringImpl::copyChars(buffer + bufferPos, source.characters16() + substringRanges[i].position, srcLen);

                bufferPos += srcLen;

            }

        }

        if (i < separatorCount) {

            if (int sepLen = separators[i].length()) {

                if (separators[i].is8Bit())

                    StringImpl::copyChars(buffer + bufferPos, separators[i].characters8(), sepLen);

                else

                    StringImpl::copyChars(buffer + bufferPos, separators[i].characters16(), sepLen);

                bufferPos += sepLen;

            }

        }

    }

    return jsString(exec, impl.release());

}

static NEVER_INLINE EncodedJSValue removeUsingRegExpSearch(ExecState* exec, JSString* string, const String& source, RegExp* regExp)

{

    size_t lastIndex = 0;

    unsigned startPosition = 0;

    Vector<StringRange, 16> sourceRanges;

    VM* vm = &exec->vm();

    RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();

    unsigned sourceLen = source.length();

    while (true) {

        MatchResult result = regExpConstructor->performMatch(*vm, regExp, string, source, startPosition);

        if (!result)

            break;

        if (lastIndex < result.start)

            sourceRanges.append(StringRange(lastIndex, result.start - lastIndex));

        lastIndex = result.end;

        startPosition = lastIndex;

        // special case of empty match

        if (result.empty()) {

            startPosition++;

            if (startPosition > sourceLen)

                break;

        }

    }

    if (!lastIndex)

        return JSValue::encode(string);

    if (static_cast<unsigned>(lastIndex) < sourceLen)

        sourceRanges.append(StringRange(lastIndex, sourceLen - lastIndex));

    return JSValue::encode(jsSpliceSubstrings(exec, string, source, sourceRanges.data(), sourceRanges.size()));

}

EncodedJSValue JSC_HOST_CALL regExpProtoFuncReplaceSymbol(ExecState* exec)

{

    // FIXME: This function should probably be reimplemented in JS when updating to ES6 as it will

    // need to perform a lot of [[Get]]s.

    JSValue searchValue = exec->thisValue();

    if (!jsDynamicCast<RegExpObject*>(searchValue))

        return throwVMTypeError(exec, "RegExp.prototype[Symbol.replace] expected |this| to be a RegExp object.");

    JSString* string = exec->argument(0).toString(exec);

    JSValue replaceValue = exec->argument(1);

    String replacementString;

    CallData callData;

    CallType callType = getCallData(replaceValue, callData);

    if (callType == CallTypeNone)

        replacementString = replaceValue.toString(exec)->value(exec);

    const String& source = string->value(exec);

    unsigned sourceLen = source.length();

    if (exec->hadException())

        return JSValue::encode(JSValue());

    RegExpObject* regExpObject = asRegExpObject(searchValue);

    RegExp* regExp = regExpObject->regExp();

    bool global = regExp->global();

    if (global) {

        // ES5.1 15.5.4.10 step 8.a.

        regExpObject->setLastIndex(exec, 0);

        if (exec->hadException())

            return JSValue::encode(JSValue());

        if (callType == CallTypeNone && !replacementString.length())

            return removeUsingRegExpSearch(exec, string, source, regExp);

    }

    RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();

    size_t lastIndex = 0;

    unsigned startPosition = 0;

    Vector<StringRange, 16> sourceRanges;

    Vector<String, 16> replacements;

    // This is either a loop (if global is set) or a one-way (if not).

    if (global && callType == CallTypeJS) {

        // regExp->numSubpatterns() + 1 for pattern args, + 2 for match start and string

        int argCount = regExp->numSubpatterns() + 1 + 2;

        JSFunction* func = jsCast<JSFunction*>(replaceValue);

        CachedCall cachedCall(exec, func, argCount);

        if (exec->hadException())

            return JSValue::encode(jsNull());

        VM* vm = &exec->vm();

        if (source.is8Bit()) {

            while (true) {

                int* ovector;

                MatchResult result = regExpConstructor->performMatch(*vm, regExp, string, source, startPosition, &ovector);

                if (!result)

                    break;

                sourceRanges.append(StringRange(lastIndex, result.start - lastIndex));

                unsigned i = 0;

                for (; i < regExp->numSubpatterns() + 1; ++i) {

                    int matchStart = ovector[i * 2];

                    int matchLen = ovector[i * 2 + 1] - matchStart;

                    if (matchStart < 0)

                        cachedCall.setArgument(i, jsUndefined());

                    else

                        cachedCall.setArgument(i, jsSubstring8(vm, source, matchStart, matchLen));

                }

                cachedCall.setArgument(i++, jsNumber(result.start));

                cachedCall.setArgument(i++, string);

                cachedCall.setThis(jsUndefined());

                JSValue jsResult = cachedCall.call();

                replacements.append(jsResult.toString(exec)->value(exec));

                if (exec->hadException())

                    break;

                lastIndex = result.end;

                startPosition = lastIndex;

                // special case of empty match

                if (result.empty()) {

                    startPosition++;

                    if (startPosition > sourceLen)

                        break;

                }

            }

        } else {

            while (true) {

                int* ovector;

                MatchResult result = regExpConstructor->performMatch(*vm, regExp, string, source, startPosition, &ovector);

                if (!result)

                    break;

                sourceRanges.append(StringRange(lastIndex, result.start - lastIndex));

                unsigned i = 0;

                for (; i < regExp->numSubpatterns() + 1; ++i) {

                    int matchStart = ovector[i * 2];

                    int matchLen = ovector[i * 2 + 1] - matchStart;

                    if (matchStart < 0)

                        cachedCall.setArgument(i, jsUndefined());

                    else

                        cachedCall.setArgument(i, jsSubstring(vm, source, matchStart, matchLen));

                }

                cachedCall.setArgument(i++, jsNumber(result.start));

                cachedCall.setArgument(i++, string);

                cachedCall.setThis(jsUndefined());

                JSValue jsResult = cachedCall.call();

                replacements.append(jsResult.toString(exec)->value(exec));

                if (exec->hadException())

                    break;

                lastIndex = result.end;

                startPosition = lastIndex;

                // special case of empty match

                if (result.empty()) {

                    startPosition++;

                    if (startPosition > sourceLen)

                        break;

                }

            }

        }

    } else {

        VM* vm = &exec->vm();

        do {

            int* ovector;

            MatchResult result = regExpConstructor->performMatch(*vm, regExp, string, source, startPosition, &ovector);

            if (!result)

                break;

            if (callType != CallTypeNone) {

                sourceRanges.append(StringRange(lastIndex, result.start - lastIndex));

                MarkedArgumentBuffer args;

                for (unsigned i = 0; i < regExp->numSubpatterns() + 1; ++i) {

                    int matchStart = ovector[i * 2];

                    int matchLen = ovector[i * 2 + 1] - matchStart;

                    if (matchStart < 0)

                        args.append(jsUndefined());

                    else

                        args.append(jsSubstring(exec, source, matchStart, matchLen));

                }

                args.append(jsNumber(result.start));

                args.append(string);

                replacements.append(call(exec, replaceValue, callType, callData, jsUndefined(), args).toString(exec)->value(exec));

                if (exec->hadException())

                    break;

            } else {

                int replLen = replacementString.length();

                if (lastIndex < result.start || replLen) {

                    sourceRanges.append(StringRange(lastIndex, result.start - lastIndex));

                    if (replLen)

                        replacements.append(substituteBackreferences(replacementString, source, ovector, regExp));

                    else

                        replacements.append(String());

                }

            }

            lastIndex = result.end;

            startPosition = lastIndex;

            // special case of empty match

            if (result.empty()) {

                startPosition++;

                if (startPosition > sourceLen)

                    break;

            }

        } while (global);

    }

    if (!lastIndex && replacements.isEmpty())

        return JSValue::encode(string);

    if (static_cast<unsigned>(lastIndex) < sourceLen)

        sourceRanges.append(StringRange(lastIndex, sourceLen - lastIndex));

    return JSValue::encode(jsSpliceSubstringsWithSeparators(exec, string, source, sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size()));

}

    void finishCreation(VM&, JSGlobalObject*);

String NEVER_INLINE substituteBackreferencesSlow(StringView replacement, StringView source, const int* ovector, RegExp*, size_t);

inline String substituteBackreferences(const String& replacement, StringView source, const int* ovector, RegExp* reg)

{

    size_t i = replacement.find('$');

    if (UNLIKELY(i != notFound))

        return substituteBackreferencesSlow(replacement, source, ovector, reg, i);

    return replacement;

}

#include "RegExpPrototype.h"

    JSValue replaceValue = exec->argument(1);

    if (!searchValue.isUndefinedOrNull()) {

        JSValue replaceFunction = searchValue.get(exec, exec->propertyNames().replaceSymbol);

        if (exec->hadException())

            return JSValue::encode(jsUndefined());

        if (!replaceFunction.isUndefinedOrNull()) {

            CallData callData;

            CallType callType = getCallData(replaceFunction, callData);

            if (callType == CallTypeNone)

                return throwVMTypeError(exec, "Symbol.replace on the first argument of String.prototype.replace was not a function");

            MarkedArgumentBuffer callArgs;

            callArgs.append(thisValue);

            callArgs.append(replaceValue);

            return JSValue::encode(call(exec, replaceFunction, callType, callData, searchValue, callArgs));

        }

    }

    JSString* string = thisValue.toString(exec);

    if (exec->hadException())

        return JSValue::encode(jsUndefined());

2015-11-02  Keith Miller  <keith_miller@apple.com>

        [ES6] Add support for Symbol.replace.

        https://bugs.webkit.org/show_bug.cgi?id=150812

        Reviewed by NOBODY (OOPS!).

        Fix test as Symbol now has a replace property.

        * js/Object-getOwnPropertyNames-expected.txt:

        * js/script-tests/Object-getOwnPropertyNames.js: