<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[199731] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/199731">199731</a></dd>
<dt>Author</dt> <dd>mark.lam@apple.com</dd>
<dt>Date</dt> <dd>2016-04-19 10:25:20 -0700 (Tue, 19 Apr 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Re-landing: ES6: Implement String.prototype.split and RegExp.prototype[@@split].
https://bugs.webkit.org/show_bug.cgi?id=156013

Reviewed by Keith Miller.

Source/JavaScriptCore:

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/GlobalObject.js:
(speciesConstructor):
* builtins/PromisePrototype.js:
- refactored to use the @speciesConstructor internal function.

* builtins/RegExpPrototype.js:
(advanceStringIndex):
- refactored from @advanceStringIndexUnicode() to be match the spec.
  Benchmarks show that there's no advantage in doing the unicode check outside
  of the advanceStringIndexUnicode part.  So, I simplified the code to match the
  spec (especially since @@split needs to call advanceStringIndex from more than
  1 location).
(match):
- Removed an unnecessary call to @Object because it was already proven above.
- Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
  Again, there's no perf regression for this.
(regExpExec):
(hasObservableSideEffectsForRegExpSplit):
(split):
(advanceStringIndexUnicode): Deleted.

* builtins/StringPrototype.js:
(split):
- Modified to use RegExp.prototype[@@split].

* bytecode/BytecodeIntrinsicRegistry.cpp:
(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
(JSC::BytecodeIntrinsicRegistry::lookup):
* bytecode/BytecodeIntrinsicRegistry.h:
- Added the @@split symbol.

* runtime/CommonIdentifiers.h:
* runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
(JSC::esSpecIsConstructor):
(JSC::esSpecIsRegExp):
* runtime/ECMAScriptSpecInternalFunctions.h: Added.

* runtime/JSGlobalObject.cpp:
(JSC::getGetterById):
(JSC::JSGlobalObject::init):

* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::setDescriptor):
- Removed an assert that is no longer valid.

* runtime/RegExpObject.h:
- Made advanceStringUnicode() public so that it can be re-used by the regexp split
  fast path.

* runtime/RegExpPrototype.cpp:
(JSC::RegExpPrototype::finishCreation):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncSearch):
(JSC::advanceStringIndex):
(JSC::regExpProtoFuncSplitFast):
* runtime/RegExpPrototype.h:

* runtime/StringObject.h:
(JSC::jsStringWithReuse):
(JSC::jsSubstring):
- Hoisted some utility functions from StringPrototype.cpp so that they can be
  reused by the regexp split fast path.

* runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
(JSC::stringProtoFuncSplitFast):
(JSC::stringProtoFuncSubstr):
(JSC::builtinStringSubstrInternal):
(JSC::stringProtoFuncSubstring):
(JSC::stringIncludesImpl):
(JSC::stringProtoFuncIncludes):
(JSC::builtinStringIncludesInternal):
(JSC::jsStringWithReuse): Deleted.
(JSC::jsSubstring): Deleted.
(JSC::stringProtoFuncSplit): Deleted.
* runtime/StringPrototype.h:

* tests/es6.yaml:

LayoutTests:

* js/Object-getOwnPropertyNames-expected.txt:
* js/dom/string-prototype-properties-expected.txt:

* js/regress/regexp-prototype-split-observable-side-effects-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects2-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects2.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-flags.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-global.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-multiline.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-sticky.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects3-unicode.html: Added.
* js/regress/regexp-prototype-split-observable-side-effects4-expected.txt: Added.
* js/regress/regexp-prototype-split-observable-side-effects4.html: Added.

* js/regress/script-tests/regexp-prototype-split-observable-side-effects.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js: Added.
* js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js: Added.

* js/regress/script-tests/string-prototype-split-observable-side-effects.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects2.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js: Added.
* js/regress/script-tests/string-prototype-split-observable-side-effects4.js: Added.

* js/regress/string-prototype-split-observable-side-effects-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects.html: Added.
* js/regress/string-prototype-split-observable-side-effects2-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects2.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-flags.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-global-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-global.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-multiline.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-sticky.html: Added.
* js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects3-unicode.html: Added.
* js/regress/string-prototype-split-observable-side-effects4-expected.txt: Added.
* js/regress/string-prototype-split-observable-side-effects4.html: Added.

* js/script-tests/Object-getOwnPropertyNames.js:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsjsObjectgetOwnPropertyNamesexpectedtxt">trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomstringprototypepropertiesexpectedtxt">trunk/LayoutTests/js/dom/string-prototype-properties-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsscripttestsObjectgetOwnPropertyNamesjs">trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js</a></li>
<li><a href="#trunkLayoutTestssputnikConformance15_Native_Objects155_String1554155414_StringprototypesplitS155414_A1_T3expectedtxt">trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsGlobalObjectjs">trunk/Source/JavaScriptCore/builtins/GlobalObject.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsPromisePrototypejs">trunk/Source/JavaScriptCore/builtins/PromisePrototype.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsRegExpPrototypejs">trunk/Source/JavaScriptCore/builtins/RegExpPrototype.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsStringPrototypejs">trunk/Source/JavaScriptCore/builtins/StringPrototype.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistrycpp">trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh">trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonIdentifiersh">trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertyDescriptorcpp">trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpObjecth">trunk/Source/JavaScriptCore/runtime/RegExpObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpPrototypecpp">trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpPrototypeh">trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringObjecth">trunk/Source/JavaScriptCore/runtime/StringObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringPrototypecpp">trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringPrototypeh">trunk/Source/JavaScriptCore/runtime/StringPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestses6yaml">trunk/Source/JavaScriptCore/tests/es6.yaml</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffectsexpectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffectshtml">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects2expectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects2html">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3flagsexpectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3flagshtml">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3globalexpectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3globalhtml">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3ignoreCaseexpectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3ignoreCasehtml">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3multilineexpectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3multilinehtml">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3stickyexpectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3stickyhtml">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3unicodeexpectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3unicodehtml">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode.html</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects4expectedtxt">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects4html">trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffectsjs">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects2js">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3flagsjs">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3globaljs">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3ignoreCasejs">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3multilinejs">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3stickyjs">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3unicodejs">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects4js">trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffectsjs">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects2js">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects2.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3flagsjs">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3globaljs">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3ignoreCasejs">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3multilinejs">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3stickyjs">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3unicodejs">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects4js">trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects4.js</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffectsexpectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffectshtml">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects2expectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects2html">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3flagsexpectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3flagshtml">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3globalexpectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3globalhtml">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3ignoreCaseexpectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3ignoreCasehtml">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3multilineexpectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3multilinehtml">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3stickyexpectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3stickyhtml">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3unicodeexpectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3unicodehtml">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode.html</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects4expectedtxt">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects4html">trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4.html</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeECMAScriptSpecInternalFunctionscpp">trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeECMAScriptSpecInternalFunctionsh">trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/LayoutTests/ChangeLog        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,3 +1,74 @@
</span><ins>+2016-04-19  Mark Lam  &lt;mark.lam@apple.com&gt;
+
+        Re-landing: ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Reviewed by Keith Miller.
+
+        * js/Object-getOwnPropertyNames-expected.txt:
+        * js/dom/string-prototype-properties-expected.txt:
+
+        * js/regress/regexp-prototype-split-observable-side-effects-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects2-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects2.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-flags.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-global.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-multiline.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-sticky.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects3-unicode.html: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects4-expected.txt: Added.
+        * js/regress/regexp-prototype-split-observable-side-effects4.html: Added.
+
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js: Added.
+        * js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js: Added.
+
+        * js/regress/script-tests/string-prototype-split-observable-side-effects.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects2.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js: Added.
+        * js/regress/script-tests/string-prototype-split-observable-side-effects4.js: Added.
+
+        * js/regress/string-prototype-split-observable-side-effects-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects2-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects2.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-flags.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-global-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-global.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-multiline.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-sticky.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects3-unicode.html: Added.
+        * js/regress/string-prototype-split-observable-side-effects4-expected.txt: Added.
+        * js/regress/string-prototype-split-observable-side-effects4.html: Added.
+
+        * js/script-tests/Object-getOwnPropertyNames.js:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:
+
</ins><span class="cx"> 2016-04-19  Brady Eidson  &lt;beidson@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Modern IDB: ObjectStore Blob Support.
</span></span></pre></div>
<a id="trunkLayoutTestsjsObjectgetOwnPropertyNamesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx"> PASS getSortedOwnPropertyNames(Error.prototype) is ['constructor', 'message', 'name', 'toString']
</span><span class="cx"> PASS getSortedOwnPropertyNames(Math) is ['E','LN10','LN2','LOG10E','LOG2E','PI','SQRT1_2','SQRT2','abs','acos','acosh','asin','asinh','atan','atan2','atanh','cbrt','ceil','clz32','cos','cosh','exp','expm1','floor','fround','hypot','imul','log','log10','log1p','log2','max','min','pow','random','round','sign','sin','sinh','sqrt','tan','tanh','trunc']
</span><span class="cx"> PASS getSortedOwnPropertyNames(JSON) is ['parse', 'stringify']
</span><del>-PASS getSortedOwnPropertyNames(Symbol) is ['for', 'hasInstance', 'isConcatSpreadable', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'toPrimitive', 'toStringTag', 'unscopables']
</del><ins>+PASS getSortedOwnPropertyNames(Symbol) is ['for', 'hasInstance', 'isConcatSpreadable', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'split', 'toPrimitive', 'toStringTag', 'unscopables']
</ins><span class="cx"> PASS getSortedOwnPropertyNames(Symbol.prototype) is ['constructor', 'toString', 'valueOf']
</span><span class="cx"> PASS getSortedOwnPropertyNames(Map) is ['length', 'name', 'prototype']
</span><span class="cx"> PASS getSortedOwnPropertyNames(Map.prototype) is ['clear', 'constructor', 'delete', 'entries', 'forEach', 'get', 'has', 'keys', 'set', 'size', 'values']
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomstringprototypepropertiesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/string-prototype-properties-expected.txt (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/string-prototype-properties-expected.txt        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/LayoutTests/js/dom/string-prototype-properties-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -14,7 +14,7 @@
</span><span class="cx"> PASS String.prototype.replace.call(undefined, /2+/, '-') threw exception TypeError: Type error.
</span><span class="cx"> PASS String.prototype.search.call(undefined, '4') threw exception TypeError: String.prototype.search requires that |this| not be undefined.
</span><span class="cx"> PASS String.prototype.slice.call(undefined, 1, 3) threw exception TypeError: Type error.
</span><del>-PASS String.prototype.split.call(undefined, '2') threw exception TypeError: Type error.
</del><ins>+PASS String.prototype.split.call(undefined, '2') threw exception TypeError: String.prototype.split requires that |this| not be undefined.
</ins><span class="cx"> PASS String.prototype.slice.call(undefined, 1, 3) threw exception TypeError: Type error.
</span><span class="cx"> PASS String.prototype.substr.call(undefined, 1, 3) threw exception TypeError: Type error.
</span><span class="cx"> PASS String.prototype.substring.call(undefined, 1, 3) threw exception TypeError: Type error.
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffectsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffectshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects2expectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects2
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects2html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects2.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects2.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3flagsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects3-flags
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3flagshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-flags.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects3-flags.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3globalexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects3-global
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3globalhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-global.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects3-global.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3ignoreCaseexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects3-ignoreCase
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3ignoreCasehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-ignoreCase.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3multilineexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects3-multiline
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3multilinehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-multiline.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects3-multiline.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3stickyexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects3-sticky
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3stickyhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-sticky.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects3-sticky.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3unicodeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects3-unicode
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects3unicodehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects3-unicode.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects3-unicode.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects4expectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/regexp-prototype-split-observable-side-effects4
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressregexpprototypesplitobservablesideeffects4html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/regexp-prototype-split-observable-side-effects4.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/regexp-prototype-split-observable-side-effects4.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffectsjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,406 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// Subclass with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp { }
+    Object.defineProperty(TestRegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+    let obj = new TestRegExp(/it/);
+    let errorStr;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;Symbol(Symbol.species)&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// RegExp subclass with constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        constructor(str, flags) {
+            super(str, flags);
+            accesses.push(&quot;constructor&quot;);
+        }
+    }
+    let obj = new TestRegExp(&quot;it&quot;);
+
+    assert(accesses == &quot;constructor&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;constructor,constructor&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// An object with species constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push(&quot;constructor&quot;);
+        return /it/y;
+    };
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;constructor&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// RegExp object with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flags = [ &quot;flags&quot;, &quot;global&quot;, &quot;ignoreCase&quot;, &quot;multiline&quot;, &quot;sticky&quot;, &quot;unicode&quot; ];
+    let flagValues = [ &quot;&quot;, false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            let obj = /it/;
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    passed = true;
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+            let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+            assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+            assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags in subclass method: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flags = [ &quot;flags&quot;, &quot;global&quot;, &quot;ignoreCase&quot;, &quot;multiline&quot;, &quot;sticky&quot;, &quot;unicode&quot; ];
+    let flagValues = [ &quot;&quot;, false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp {
+                get [flag]() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            };
+            let obj = new TestRegExp(/it/);
+
+            assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+            let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+            assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+            assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags using Object.defineProperty: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flags = [ &quot;flags&quot;, &quot;global&quot;, &quot;ignoreCase&quot;, &quot;multiline&quot;, &quot;sticky&quot;, &quot;unicode&quot; ];
+    let flagValues = [ &quot;&quot;, false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp { };
+            let obj = new TestRegExp(/it/);
+
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+            let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+            assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+            assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// Any object with species constructor: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push(&quot;constructor&quot;);
+        return /it/y;
+    };
+
+    Object.defineProperty(obj, &quot;flags&quot;, {
+        get: function() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    });
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;flags,constructor&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Any object with custom prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+    let TestRegExpProto = {
+        get flags() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        },
+        toString() {
+            accesses.push(&quot;toString&quot;);
+            return this._regex.toString();
+        },
+        get source() {
+            accesses.push(&quot;source&quot;);
+            return this._regex.source;
+        }
+    }
+    TestRegExpProto.__proto__ = RegExp.prototype;
+
+    let TestRegExp = function(regex) {
+        accesses.push(&quot;constructor&quot;);
+        this._regex = new RegExp(regex);
+    }
+    TestRegExp.prototype = TestRegExpProto;
+    TestRegExpProto.constructor = TestRegExp;
+
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == &quot;constructor&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;constructor,flags,source&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class RegExpB extends RegExp {
+        get flags() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    }
+    class RegExpC extends RegExpB { }
+
+    assert(RegExpB.__proto__ == RegExp);
+    assert(RegExpC.__proto__ == RegExpB);
+
+    let obj = new RegExpC(/it/);
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;flags&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses with substituted prototype before instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, &quot;flags&quot;, {
+        get: function() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    });
+    Object.defineProperty(X.prototype, &quot;exec&quot;, {
+        value: function(str) {
+            accesses.push(&quot;exec&quot;);
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of &quot;it&quot;.
+            return matchResult;
+        }
+    });
+
+    // Monkey with the prototype chain before instantiating C.
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    let obj = new C;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;flags,exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses with substituted prototype after instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, &quot;flags&quot;, {
+        get: function() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    });
+    Object.defineProperty(X.prototype, &quot;exec&quot;, {
+        value: function(str) {
+            accesses.push(&quot;exec&quot;);
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of &quot;it&quot;.
+            return matchResult;
+        }
+    });
+
+    // Instantiate C before monkeying with the prototype chain.
+    let obj = new C();
+
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;flags,exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses with proxied prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { };
+
+    assert(B.__proto__ === RegExp);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+
+    let proxy = new Proxy(RegExp.prototype, {
+        get: function(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop === &quot;exec&quot;) {
+                return function(str) {
+                    accesses.push(&quot;in_exec&quot;);
+                    var matchResult = /it/y.exec(str.substr(this.lastIndex));
+                    if (matchResult)
+                        this.lastIndex += 2; // length of &quot;it&quot;.
+                    return matchResult;
+                }
+            }
+            return obj[prop];
+        }
+    });
+    B.prototype.__proto__ = proxy;
+
+    let obj = new B();
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;flags,Symbol(Symbol.match),exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// RegExp subclass with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        exec(str) {
+            accesses.push(&quot;exec&quot;);
+            return RegExp.prototype.exec.call(this, str);
+        }
+    };
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Proxied RegExp observing every get.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(proxy, &quot;splitme&quot;);
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == &quot;constructor,flags,Symbol(Symbol.match),source&quot;,
+        &quot;Proxy not able to observe some gets&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Proxied RegExp (without @@match) observing every get.
+// This is to force the RegExp @species constructor to access source.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop == Symbol.match)
+                return undefined;
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(proxy, &quot;splitme&quot;);
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == &quot;constructor,flags,Symbol(Symbol.match),Symbol(Symbol.toPrimitive),toString,source,flags&quot;,
+        &quot;Proxy not able to observe some gets&quot;);
+    // The new instance of the RegExp would have been constructed with the pattern from
+    // the proxy toString() i.e. &quot;\/lt\/&quot; instead of source, because the proxy is an
+    // object without a [@@match] property.
+    assert(result == &quot;splitme&quot;, &quot;Unexpected result&quot;);
+})();
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects2js"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects2.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,25 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp, Symbol.species);
+    Object.defineProperty(RegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+    let obj = new RegExp;
+    let errorStr;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;Symbol(Symbol.species)&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3flagsjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-flags.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;flags&quot;;
+    let flagValue = &quot;&quot;;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3globaljs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-global.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;global&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3ignoreCasejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-ignoreCase.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;ignoreCase&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3multilinejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-multiline.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;multiline&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3stickyjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-sticky.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;sticky&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects3unicodejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects3-unicode.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;unicode&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsregexpprototypesplitobservablesideeffects4js"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/regexp-prototype-split-observable-side-effects4.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,38 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, &quot;exec&quot;);
+    let origExec = origDescriptor.value;
+
+    let obj = /it/;
+    Object.defineProperty(RegExp.prototype, &quot;exec&quot;, {
+        value: function(str) {
+            accesses.push(&quot;exec&quot;);
+            return origExec.call(this, str);
+        }
+    });
+
+    // The @@split slow path should only call the internal version of substr. Make sure
+    // that it's not calling the public version which can be overridden.
+    String.prototype.substr = function(start, length) {
+        throw Error(&quot;Should not call overridden substr&quot;);
+    }
+
+    // The @@split slow path should only call the internal version of includes. Make sure
+    // that it's not calling the public version which can be overridden.
+    String.prototype.includes = function(pattern) {
+        throw Error(&quot;Should not call overridden includes&quot;);
+    }
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = RegExp.prototype[Symbol.split].call(obj, &quot;splitme&quot;);
+    assert(accesses == &quot;exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffectsjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,510 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+//======================================================================================
+// Testing the string that we're calling split on.
+
+// Proxied String subclass.
+(function () {
+    let accesses = [];
+    class ExtString extends String { }
+    var obj = new ExtString(&quot;splitme&quot;);
+    var proxy = new Proxy(obj, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop === &quot;toString&quot;) {
+                return function() {
+                    accesses.push(&quot;in_toString&quot;);
+                    return obj.toString();
+                }
+            }
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = String.prototype.split.call(proxy, &quot;it&quot;);    
+    assert(accesses == &quot;Symbol(Symbol.toPrimitive),toString,in_toString&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Object that looks like a string.
+(function () {
+    let accesses = [];
+    var obj = {
+        [Symbol.toPrimitive]() {
+            accesses.push(Symbol.toPrimitive.toString());
+            return &quot;splitme&quot;;
+        }
+    }
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = String.prototype.split.call(obj, &quot;it&quot;);    
+    assert(accesses == &quot;Symbol(Symbol.toPrimitive)&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Object that looks like a string.
+(function () {
+    let accesses = [];
+    var obj = {
+        toString() {
+            accesses.push(&quot;toString&quot;);
+            return &quot;splitme&quot;;
+        }
+    }
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = String.prototype.split.call(obj, &quot;it&quot;);    
+    assert(accesses == &quot;toString&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// String subclass with overridden @@split.
+(function () {
+    let accesses = [];
+    class ExtString extends String {
+        [Symbol.split] (str) {
+            accesses.push(&quot;Symbol(Symbol.split)&quot;);
+            return RegExp.prototype[Symbol.split].call(/it/, str);
+        }
+    };
+
+    var obj = new ExtString;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);    
+    assert(accesses == &quot;Symbol(Symbol.split)&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+
+// Object with overridden @@search.
+(function () {
+    let accesses = [];
+    var obj = {
+        [Symbol.split] (str) {
+            accesses.push(&quot;Symbol(Symbol.split)&quot;);
+            return RegExp.prototype[Symbol.split].call(/it/, str);
+        },
+    }
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);    
+    assert(accesses == &quot;Symbol(Symbol.split)&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+//======================================================================================
+// Testing the regexp object that we're calling split with.
+
+// Subclass with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp { }
+    Object.defineProperty(TestRegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+    let obj = new TestRegExp;
+    let errorStr;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;Symbol(Symbol.species)&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// RegExp subclass with constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        constructor(str, flags) {
+            super(str, flags);
+            accesses.push(&quot;constructor&quot;);
+        }
+    }
+    let obj = new TestRegExp(&quot;it&quot;);
+
+    assert(accesses == &quot;constructor&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;constructor,constructor&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// An object with species constructor: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push(&quot;constructor&quot;);
+        return /it/y;
+    };
+    obj[Symbol.split] = function(str, limit) {
+        accesses.push(Symbol.split.toString());
+        return RegExp.prototype[Symbol.split].call(this, str, limit);
+    };
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;Symbol(Symbol.split),constructor&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// RegExp object with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flags = [ &quot;flags&quot;, &quot;global&quot;, &quot;ignoreCase&quot;, &quot;multiline&quot;, &quot;sticky&quot;, &quot;unicode&quot; ];
+    let flagValues = [ &quot;&quot;, false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            let obj = /it/;
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    passed = true;
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+            let result = &quot;splitme&quot;.split(obj);
+            assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+            assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags in subclass method: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flags = [ &quot;flags&quot;, &quot;global&quot;, &quot;ignoreCase&quot;, &quot;multiline&quot;, &quot;sticky&quot;, &quot;unicode&quot; ];
+    let flagValues = [ &quot;&quot;, false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp {
+                get [flag]() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            };
+            let obj = new TestRegExp(/it/);
+
+            assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+            let result = &quot;splitme&quot;.split(obj);
+            assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+            assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// RegExp subclass with overridden flags using Object.defineProperty: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flags = [ &quot;flags&quot;, &quot;global&quot;, &quot;ignoreCase&quot;, &quot;multiline&quot;, &quot;sticky&quot;, &quot;unicode&quot; ];
+    let flagValues = [ &quot;&quot;, false, false, false, false, false ];
+    for (let index in flags) {
+        (function(flag, flagValue) {
+            let accesses = [];
+            class TestRegExp extends RegExp { };
+            let obj = new TestRegExp(/it/);
+
+            Object.defineProperty(obj, flag, {
+                get: function() {
+                    accesses.push(flag);
+                    return flagValue;
+                }
+            });
+
+            assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+            let result = &quot;splitme&quot;.split(obj);
+            assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+            assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+
+        }) (flags[index], flagValues[index]);
+    }
+})();
+
+// Any object with species constructor: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+    let obj = { constructor: {} };
+    obj.constructor[Symbol.species] = function() {
+        accesses.push(&quot;constructor&quot;);
+        return /it/y;
+    };
+    obj[Symbol.split] = function(str, limit) {
+        accesses.push(Symbol.split.toString());
+        return RegExp.prototype[Symbol.split].call(this, str, limit);
+    };
+
+    Object.defineProperty(obj, &quot;flags&quot;, {
+        get: function() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    });
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;Symbol(Symbol.split),flags,constructor&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Any object with custom prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+    let TestRegExpProto = {
+        get flags() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        },
+        toString() {
+            accesses.push(&quot;toString&quot;);
+            return this._regex.toString();
+        },
+        get source() {
+            accesses.push(&quot;source&quot;);
+            return this._regex.source;
+        }
+    }
+    TestRegExpProto.__proto__ = RegExp.prototype;
+
+    let TestRegExp = function(regex) {
+        accesses.push(&quot;constructor&quot;);
+        this._regex = new RegExp(regex);
+    }
+    TestRegExp.prototype = TestRegExpProto;
+    TestRegExpProto.constructor = TestRegExp;
+
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == &quot;constructor&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;constructor,flags,source&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class RegExpB extends RegExp {
+        get flags() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    }
+    class RegExpC extends RegExpB { }
+
+    assert(RegExpB.__proto__ == RegExp);
+    assert(RegExpC.__proto__ == RegExpB);
+
+    let obj = new RegExpC(/it/);
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;flags&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses with substituted prototype before instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, &quot;flags&quot;, {
+        get: function() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    });
+    Object.defineProperty(X.prototype, &quot;exec&quot;, {
+        value: function(str) {
+            accesses.push(&quot;exec&quot;);
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of &quot;it&quot;.
+            return matchResult;
+        }
+    });
+
+    // Monkey with the prototype chain before instantiating C.
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    let obj = new C;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;flags,exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses with substituted prototype after instantiation: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { }
+    class C extends B { }
+
+    assert(B.__proto__ === RegExp);
+    assert(C.__proto__ === B);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === B.prototype);
+
+    let X = function () {}
+    Object.defineProperty(X.prototype, &quot;flags&quot;, {
+        get: function() {
+            accesses.push(&quot;flags&quot;);
+            return &quot;&quot;;
+        }
+    });
+    Object.defineProperty(X.prototype, &quot;exec&quot;, {
+        value: function(str) {
+            accesses.push(&quot;exec&quot;);
+            var matchResult = /it/y.exec(str.substr(this.lastIndex));
+            if (matchResult)
+                this.lastIndex += 2; // length of &quot;it&quot;.
+            return matchResult;
+        }
+    });
+
+    // Instantiate C before monkeying with the prototype chain.
+    let obj = new C();
+
+    X.__proto__ = RegExp;
+    X.prototype.__proto__ = RegExp.prototype;
+    C.__proto__ = X;
+    C.prototype.__proto__ = X.prototype;
+
+    assert(X.__proto__ === RegExp);
+    assert(C.__proto__ === X);
+    assert(X.prototype.__proto__ === RegExp.prototype);
+    assert(C.prototype.__proto__ === X.prototype);
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;flags,exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// 2 levels of subclasses with proxied prototype: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let accesses = [];
+
+    class B extends RegExp { };
+
+    assert(B.__proto__ === RegExp);
+    assert(B.prototype.__proto__ === RegExp.prototype);
+
+    let proxy = new Proxy(RegExp.prototype, {
+        get: function(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop === &quot;exec&quot;) {
+                return function(str) {
+                    accesses.push(&quot;in_exec&quot;);
+                    var matchResult = /it/y.exec(str.substr(this.lastIndex));
+                    if (matchResult)
+                        this.lastIndex += 2; // length of &quot;it&quot;.
+                    return matchResult;
+                }
+            }
+            return obj[prop];
+        }
+    });
+    B.prototype.__proto__ = proxy;
+
+    let obj = new B();
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;Symbol(Symbol.split),flags,Symbol(Symbol.match),exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec,exec,in_exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// RegExp subclass with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    class TestRegExp extends RegExp {
+        exec(str) {
+            accesses.push(&quot;exec&quot;);
+            return RegExp.prototype.exec.call(this, str);
+        }
+    };
+    let obj = new TestRegExp(/it/);
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Proxied RegExp observing every get.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(proxy);
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == &quot;Symbol(Symbol.split),constructor,flags,Symbol(Symbol.match),source&quot;,
+        &quot;Proxy not able to observe some gets&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
+
+// Proxied RegExp (without @@match) observing every get.
+// This is to force the RegExp @species constructor to access source.
+(function () {
+    let accesses = [];
+    let regexp = new RegExp(/it/);
+    let proxy = new Proxy(regexp, {
+        get(obj, prop) {
+            accesses.push(prop.toString());
+            if (prop == Symbol.match)
+                return undefined;
+            return obj[prop];
+        }
+    });
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(proxy);
+    // Note: @@split creates a new instance of the RegExp using its @@species, and performs
+    // the split operation with that new instance. Hence, the proxy is only able to observe
+    // gets up to the creation of the new instance.
+    assert(accesses == &quot;Symbol(Symbol.split),constructor,flags,Symbol(Symbol.match),Symbol(Symbol.toPrimitive),toString,source,flags&quot;,
+        &quot;Proxy not able to observe some gets&quot;);
+    // The new instance of the RegExp would have been constructed with the pattern from
+    // the proxy toString() i.e. &quot;\/lt\/&quot; instead of source, because the proxy is an
+    // object without a [@@match] property.
+    assert(result == &quot;splitme&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects2js"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects2.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects2.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects2.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,26 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp with overridden [@@species]: Testing ES6 21.2.5.11: 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp, Symbol.species);
+    Object.defineProperty(RegExp, Symbol.species, {
+        value: function() {
+            accesses.push(Symbol.species.toString());
+            return /it/y;
+        }
+    });
+
+    let obj = new RegExp;
+    let errorStr;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;Symbol(Symbol.species)&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3flagsjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-flags.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;flags&quot;;
+    let flagValue = &quot;&quot;;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3globaljs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-global.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;global&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3ignoreCasejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;ignoreCase&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3multilinejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-multiline.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;multiline&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3stickyjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-sticky.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;sticky&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects3unicodejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects3-unicode.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden flags: Testing ES6 21.2.5.11: 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+(function () {
+    let flag = &quot;unicode&quot;;
+    let flagValue = false;
+
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, flag);
+
+    Object.defineProperty(RegExp.prototype, flag, {
+        get: function() {
+            accesses.push(flag);
+            return flagValue;
+        }
+    });
+    let obj = /it/;
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == flag, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsstringprototypesplitobservablesideeffects4js"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects4.js (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects4.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/string-prototype-split-observable-side-effects4.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,38 @@
</span><ins>+//@ runDefault
+
+function assert(testedValue, msg) {
+    if (!testedValue)
+        throw Error(msg);
+}
+
+// RegExp.prototype with overridden exec: Testing ES6 21.2.5.11: 19.b. Let z be ? RegExpExec(splitter, S).
+(function () {
+    let accesses = [];
+    let origDescriptor = Object.getOwnPropertyDescriptor(RegExp.prototype, &quot;exec&quot;);
+    let origExec = origDescriptor.value;
+
+    let obj = /it/;
+    Object.defineProperty(RegExp.prototype, &quot;exec&quot;, {
+        value: function(str) {
+            accesses.push(&quot;exec&quot;);
+            return origExec.call(this, str);
+        }
+    });
+
+    // The @@split slow path should call an internal version of substr. Make sure that
+    // it's not calling the public version which can be overridden.
+    String.prototype.substr = function(start, length) {
+        throw Error(&quot;Should not call overridden substr&quot;);
+    }
+
+    // The @@split slow path should only call the internal version of includes. Make sure
+    // that it's not calling the public version which can be overridden.
+    String.prototype.includes = function(pattern) {
+        throw Error(&quot;Should not call overridden includes&quot;);
+    }
+
+    assert(accesses == &quot;&quot;, &quot;unexpected call to overridden props&quot;);
+    let result = &quot;splitme&quot;.split(obj);
+    assert(accesses == &quot;exec,exec,exec,exec,exec,exec&quot;, &quot;Property accesses do not match expectation&quot;);
+    assert(result == &quot;spl,me&quot;, &quot;Unexpected result&quot;);
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffectsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffectshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects2expectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects2
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects2html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects2.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects2.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3flagsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects3-flags
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3flagshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-flags.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects3-flags.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3globalexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects3-global
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3globalhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-global.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects3-global.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3ignoreCaseexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects3-ignoreCase
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3ignoreCasehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-ignoreCase.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects3-ignoreCase.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3multilineexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects3-multiline
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3multilinehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-multiline.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects3-multiline.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3stickyexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects3-sticky
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3stickyhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-sticky.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects3-sticky.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3unicodeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects3-unicode
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects3unicodehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects3-unicode.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects3-unicode.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects4expectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4-expected.txt (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/string-prototype-split-observable-side-effects4
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressstringprototypesplitobservablesideeffects4html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4.html (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/string-prototype-split-observable-side-effects4.html        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/string-prototype-split-observable-side-effects4.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsscripttestsObjectgetOwnPropertyNamesjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx">     &quot;Error.prototype&quot;: &quot;['constructor', 'message', 'name', 'toString']&quot;,
</span><span class="cx">     &quot;Math&quot;: &quot;['E','LN10','LN2','LOG10E','LOG2E','PI','SQRT1_2','SQRT2','abs','acos','acosh','asin','asinh','atan','atan2','atanh','cbrt','ceil','clz32','cos','cosh','exp','expm1','floor','fround','hypot','imul','log','log10','log1p','log2','max','min','pow','random','round','sign','sin','sinh','sqrt','tan','tanh','trunc']&quot;,
</span><span class="cx">     &quot;JSON&quot;: &quot;['parse', 'stringify']&quot;,
</span><del>-    &quot;Symbol&quot;: &quot;['for', 'hasInstance', 'isConcatSpreadable', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'toPrimitive', 'toStringTag', 'unscopables']&quot;,
</del><ins>+    &quot;Symbol&quot;: &quot;['for', 'hasInstance', 'isConcatSpreadable', 'iterator', 'keyFor', 'length', 'match', 'name', 'prototype', 'search', 'species', 'split', 'toPrimitive', 'toStringTag', 'unscopables']&quot;,
</ins><span class="cx">     &quot;Symbol.prototype&quot;: &quot;['constructor', 'toString', 'valueOf']&quot;,
</span><span class="cx">     &quot;Map&quot;: &quot;['length', 'name', 'prototype']&quot;,
</span><span class="cx">     &quot;Map.prototype&quot;: &quot;['clear', 'constructor', 'delete', 'entries', 'forEach', 'get', 'has', 'keys', 'set', 'size', 'values']&quot;,
</span></span></pre></div>
<a id="trunkLayoutTestssputnikConformance15_Native_Objects155_String1554155414_StringprototypesplitS155414_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.14_A1_T3
</span><span class="cx"> 
</span><del>-FAIL TypeError: Type error
</del><ins>+FAIL TypeError: String.prototype.split requires that |this| not be undefined
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -638,6 +638,7 @@
</span><span class="cx">     runtime/DirectArguments.cpp
</span><span class="cx">     runtime/DirectArgumentsOffset.cpp
</span><span class="cx">     runtime/DumpContext.cpp
</span><ins>+    runtime/ECMAScriptSpecInternalFunctions.cpp
</ins><span class="cx">     runtime/Error.cpp
</span><span class="cx">     runtime/ErrorConstructor.cpp
</span><span class="cx">     runtime/ErrorHandlingScope.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,3 +1,91 @@
</span><ins>+2016-04-19  Mark Lam  &lt;mark.lam@apple.com&gt;
+
+        Re-landing: ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/GlobalObject.js:
+        (speciesConstructor):
+        * builtins/PromisePrototype.js:
+        - refactored to use the @speciesConstructor internal function.
+
+        * builtins/RegExpPrototype.js:
+        (advanceStringIndex):
+        - refactored from @advanceStringIndexUnicode() to be match the spec.
+          Benchmarks show that there's no advantage in doing the unicode check outside
+          of the advanceStringIndexUnicode part.  So, I simplified the code to match the
+          spec (especially since @@split needs to call advanceStringIndex from more than
+          1 location).
+        (match):
+        - Removed an unnecessary call to @Object because it was already proven above.
+        - Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
+          Again, there's no perf regression for this.
+        (regExpExec):
+        (hasObservableSideEffectsForRegExpSplit):
+        (split):
+        (advanceStringIndexUnicode): Deleted.
+
+        * builtins/StringPrototype.js:
+        (split):
+        - Modified to use RegExp.prototype[@@split].
+
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        - Added the @@split symbol.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
+        (JSC::esSpecIsConstructor):
+        (JSC::esSpecIsRegExp):
+        * runtime/ECMAScriptSpecInternalFunctions.h: Added.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::getGetterById):
+        (JSC::JSGlobalObject::init):
+
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        - Removed an assert that is no longer valid.
+
+        * runtime/RegExpObject.h:
+        - Made advanceStringUnicode() public so that it can be re-used by the regexp split
+          fast path.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncSearch):
+        (JSC::advanceStringIndex):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/RegExpPrototype.h:
+
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        - Hoisted some utility functions from StringPrototype.cpp so that they can be
+          reused by the regexp split fast path.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::builtinStringSubstrInternal):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringIncludesImpl):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::jsStringWithReuse): Deleted.
+        (JSC::jsSubstring): Deleted.
+        (JSC::stringProtoFuncSplit): Deleted.
+        * runtime/StringPrototype.h:
+
+        * tests/es6.yaml:
+
</ins><span class="cx"> 2016-04-19  Commit Queue  &lt;commit-queue@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r199726.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -2054,6 +2054,8 @@
</span><span class="cx">                 FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1C0FFE1B194FD100B53FCA /* Exception.cpp */; };
</span><span class="cx">                 FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
</span><span class="cx">                 FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                FE318FDF1CAC982700DFCC54 /* ECMAScriptSpecInternalFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */; };
+                FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */; };
</ins><span class="cx">                 FE384EE51ADDB7AD0055DE2C /* JSDollarVM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */; };
</span><span class="cx">                 FE384EE61ADDB7AD0055DE2C /* JSDollarVM.h in Headers */ = {isa = PBXBuildFile; fileRef = FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 FE384EE71ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */; };
</span><span class="lines">@@ -4301,6 +4303,8 @@
</span><span class="cx">                 FE1C0FFE1B194FD100B53FCA /* Exception.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Exception.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntCLoop.cpp; path = llint/LLIntCLoop.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCLoop.h; path = llint/LLIntCLoop.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ECMAScriptSpecInternalFunctions.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ECMAScriptSpecInternalFunctions.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVM.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDollarVM.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVMPrototype.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -5581,6 +5585,8 @@
</span><span class="cx">                                 0FE0500E1AA9091100D33B33 /* DirectArgumentsOffset.h */,
</span><span class="cx">                                 A70447EB17A0BD7000F5898E /* DumpContext.cpp */,
</span><span class="cx">                                 A70447EC17A0BD7000F5898E /* DumpContext.h */,
</span><ins>+                                FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */,
+                                FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */,
</ins><span class="cx">                                 2AD2EDFA19799E38004D6478 /* EnumerationMode.h */,
</span><span class="cx">                                 BC337BEA0E1B00CB0076918A /* Error.cpp */,
</span><span class="cx">                                 BC3046060E1F497F003232CF /* Error.h */,
</span><span class="lines">@@ -7943,6 +7949,7 @@
</span><span class="cx">                                 52C0611F1AA51E1C00B4ADBA /* RuntimeType.h in Headers */,
</span><span class="cx">                                 C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */,
</span><span class="cx">                                 0FE050281AA9095600D33B33 /* ScopedArguments.h in Headers */,
</span><ins>+                                FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */,
</ins><span class="cx">                                 0FE050291AA9095600D33B33 /* ScopedArgumentsTable.h in Headers */,
</span><span class="cx">                                 0FE0502B1AA9095600D33B33 /* ScopeOffset.h in Headers */,
</span><span class="cx">                                 0F24E55217EE274900ABB217 /* ScratchRegisterAllocator.h in Headers */,
</span><span class="lines">@@ -8760,6 +8767,7 @@
</span><span class="cx">                                 FE5068671AE25E280009DAB7 /* DeferredSourceDump.cpp in Sources */,
</span><span class="cx">                                 A77A423D17A0BBFD00A8DB81 /* DFGAbstractHeap.cpp in Sources */,
</span><span class="cx">                                 0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */,
</span><ins>+                                FE318FDF1CAC982700DFCC54 /* ECMAScriptSpecInternalFunctions.cpp in Sources */,
</ins><span class="cx">                                 0FD3E4011B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp in Sources */,
</span><span class="cx">                                 0F18D3CF1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp in Sources */,
</span><span class="cx">                                 0F2DD8111AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsGlobalObjectjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/GlobalObject.js (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/GlobalObject.js        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/builtins/GlobalObject.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -60,3 +61,18 @@
</span><span class="cx"> {
</span><span class="cx">     return this;
</span><span class="cx"> }
</span><ins>+
+function speciesConstructor(obj, defaultConstructor)
+{
+    var constructor = obj.constructor;
+    if (constructor === @undefined)
+        return defaultConstructor;
+    if (!@isObject(constructor))
+        throw new @TypeError(&quot;|this|.constructor is not an Object or undefined&quot;);
+    constructor = constructor[@symbolSpecies];
+    if (constructor == null)
+        return defaultConstructor;
+    if (@isConstructor(constructor))
+        return constructor;
+    throw new @TypeError(&quot;|this|.constructor[Symbol.species] is not a constructor&quot;);
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsPromisePrototypejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/PromisePrototype.js (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/PromisePrototype.js        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/builtins/PromisePrototype.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,16 +37,7 @@
</span><span class="cx">     if (!@isPromise(this))
</span><span class="cx">         throw new @TypeError(&quot;|this| is not a object&quot;);
</span><span class="cx"> 
</span><del>-    var constructor = this.constructor;
-    if (constructor === @undefined)
-        constructor = @Promise;
-    else if (!@isObject(constructor))
-        throw new @TypeError(&quot;|this|.constructor is not an Object or undefined&quot;);
-    else {
-        constructor = constructor[@symbolSpecies];
-        if (constructor == null)
-            constructor = @Promise;
-    }
</del><ins>+    var constructor = @speciesConstructor(this, @Promise);
</ins><span class="cx"> 
</span><span class="cx">     var resultCapability = @newPromiseCapability(constructor);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsRegExpPrototypejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/RegExpPrototype.js (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/RegExpPrototype.js        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/builtins/RegExpPrototype.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -23,15 +23,17 @@
</span><span class="cx">  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx">  */
</span><span class="cx"> 
</span><del>-function advanceStringIndexUnicode(string, stringLength, index)
</del><ins>+function advanceStringIndex(string, index, unicode)
</ins><span class="cx"> {
</span><del>-    // This function implements AdvanceStringIndex described in ES6 21.2.5.2.3, steps 6-11.
-    // It assumes that &quot;unicode&quot; is true for its callers.
</del><ins>+    // This function implements AdvanceStringIndex described in ES6 21.2.5.2.3.
</ins><span class="cx">     &quot;use strict&quot;;
</span><span class="cx"> 
</span><del>-    if (index + 1 &gt;= stringLength)
</del><ins>+    if (!unicode)
</ins><span class="cx">         return index + 1;
</span><span class="cx"> 
</span><ins>+    if (index + 1 &gt;= string.length)
+        return index + 1;
+
</ins><span class="cx">     let first = string.@charCodeAt(index);
</span><span class="cx">     if (first &lt; 0xD800 || first &gt; 0xDBFF)
</span><span class="cx">         return index + 1;
</span><span class="lines">@@ -50,7 +52,7 @@
</span><span class="cx">     if (!@isObject(this))
</span><span class="cx">         throw new @TypeError(&quot;RegExp.prototype.@@match requires that |this| be an Object&quot;);
</span><span class="cx"> 
</span><del>-    let regexp = @Object(this);
</del><ins>+    let regexp = this;
</ins><span class="cx">     let stringArg = @toString(str);
</span><span class="cx"> 
</span><span class="cx">     if (!regexp.global)
</span><span class="lines">@@ -79,12 +81,8 @@
</span><span class="cx"> 
</span><span class="cx">             let resultString = @toString(result[0]);
</span><span class="cx"> 
</span><del>-            if (!resultString.length) {
-                if (unicode)
-                    regexp.lastIndex = @advanceStringIndexUnicode(stringArg, stringLength, regexp.lastIndex);
-                else
-                    regexp.lastIndex++;
-            }
</del><ins>+            if (!resultString.length)
+                regexp.lastIndex = @advanceStringIndex(stringArg, regexp.lastIndex, unicode);
</ins><span class="cx"> 
</span><span class="cx">             resultList.@push(resultString);
</span><span class="cx"> 
</span><span class="lines">@@ -95,3 +93,187 @@
</span><span class="cx">     return regexp.@match(stringArg);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+function regExpExec(regexp, str)
+{
+    &quot;use strict&quot;;
+
+    let exec = regexp.exec;
+    let builtinExec = @RegExp.prototype.@exec;
+    if (exec !== builtinExec &amp;&amp; typeof exec === &quot;function&quot;) {
+        let result = exec.@call(regexp, str);
+        if (result !== null &amp;&amp; !@isObject(result))
+            throw new @TypeError(&quot;The result of a RegExp exec must be null or an object&quot;);
+        return result;
+    }
+    return builtinExec.@call(regexp, str);
+}
+
+function hasObservableSideEffectsForRegExpSplit(regexp) {
+    // This is accessed by the RegExpExec internal function.
+    let regexpExec = @tryGetById(regexp, &quot;exec&quot;);
+    if (regexpExec !== @RegExp.prototype.@exec)
+        return true;
+    
+    // This is accessed by step 5 below.
+    let regexpFlags = @tryGetById(regexp, &quot;flags&quot;);
+    if (regexpFlags !== @regExpProtoFlagsGetter)
+        return true;
+    
+    // These are accessed by the builtin flags getter.
+    let regexpGlobal = @tryGetById(regexp, &quot;global&quot;);
+    if (regexpGlobal !== @regExpProtoGlobalGetter)
+        return true;
+    let regexpIgnoreCase = @tryGetById(regexp, &quot;ignoreCase&quot;);
+    if (regexpIgnoreCase !== @regExpProtoIgnoreCaseGetter)
+        return true;
+    let regexpMultiline = @tryGetById(regexp, &quot;multiline&quot;);
+    if (regexpMultiline !== @regExpProtoMultilineGetter)
+        return true;
+    let regexpSticky = @tryGetById(regexp, &quot;sticky&quot;);
+    if (regexpSticky !== @regExpProtoStickyGetter)
+        return true;
+    let regexpUnicode = @tryGetById(regexp, &quot;unicode&quot;);
+    if (regexpUnicode !== @regExpProtoUnicodeGetter)
+        return true;
+    
+    // This is accessed by the RegExp species constructor.
+    let regexpSource = @tryGetById(regexp, &quot;source&quot;);
+    if (regexpSource !== @regExpProtoSourceGetter)
+        return true;
+    
+    return !@isRegExp(regexp);
+}
+
+// ES 21.2.5.11 RegExp.prototype[@@split](string, limit)
+function split(string, limit)
+{
+    &quot;use strict&quot;;
+
+    // 1. Let rx be the this value.
+    // 2. If Type(rx) is not Object, throw a TypeError exception.
+    if (!@isObject(this))
+        throw new @TypeError(&quot;RegExp.prototype.@@split requires that |this| be an Object&quot;);
+    let regexp = this;
+
+    // 3. Let S be ? ToString(string).
+    let str = @toString(string);
+
+    // 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+    let speciesConstructor = @speciesConstructor(regexp, @RegExp);
+
+    if (speciesConstructor === @RegExp &amp;&amp; !@hasObservableSideEffectsForRegExpSplit(regexp))
+        return @regExpSplitFast.@call(regexp, str, limit);
+
+    // 5. Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+    let flags = @toString(regexp.flags);
+
+    // 6. If flags contains &quot;u&quot;, let unicodeMatching be true.
+    // 7. Else, let unicodeMatching be false.
+    let unicodeMatching = @stringIncludesInternal.@call(flags, &quot;u&quot;);
+    // 8. If flags contains &quot;y&quot;, let newFlags be flags.
+    // 9. Else, let newFlags be the string that is the concatenation of flags and &quot;y&quot;.
+    let newFlags = @stringIncludesInternal.@call(flags, &quot;y&quot;) ? flags : flags + &quot;y&quot;;
+
+    // 10. Let splitter be ? Construct(C, Â« rx, newFlags Â»).
+    let splitter = new speciesConstructor(regexp, newFlags);
+
+    // We need to check again for RegExp subclasses that will fail the speciesConstructor test
+    // but can still use the fast path after we invoke the constructor above.
+    if (!@hasObservableSideEffectsForRegExpSplit(splitter))
+        return @regExpSplitFast.@call(splitter, str, limit);
+
+    // 11. Let A be ArrayCreate(0).
+    // 12. Let lengthA be 0.
+    let result = [];
+
+    // 13. If limit is undefined, let lim be 2^32-1; else let lim be ? ToUint32(limit).
+    limit = (limit === @undefined) ? 0xffffffff : limit &gt;&gt;&gt; 0;
+
+    // 16. If lim = 0, return A.
+    if (!limit)
+        return result;
+
+    // 14. [Defered from above] Let size be the number of elements in S.
+    let size = str.length;
+
+    // 17. If size = 0, then
+    if (!size) {
+        // a. Let z be ? RegExpExec(splitter, S).
+        let z = @regExpExec(splitter, str);
+        // b. If z is not null, return A.
+        if (z != null)
+            return result;
+        // c. Perform ! CreateDataProperty(A, &quot;0&quot;, S).
+        @putByValDirect(result, 0, str);
+        // d. Return A.
+        return result;
+    }
+
+    // 15. [Defered from above] Let p be 0.
+    let position = 0;
+    // 18. Let q be p.
+    let matchPosition = 0;
+
+    // 19. Repeat, while q &lt; size
+    while (matchPosition &lt; size) {
+        // a. Perform ? Set(splitter, &quot;lastIndex&quot;, q, true).
+        splitter.lastIndex = matchPosition;
+        // b. Let z be ? RegExpExec(splitter, S).
+        let matches = @regExpExec(splitter, str);
+        // c. If z is null, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (matches === null)
+            matchPosition = @advanceStringIndex(str, matchPosition, unicodeMatching);
+        // d. Else z is not null,
+        else {
+            // i. Let e be ? ToLength(? Get(splitter, &quot;lastIndex&quot;)).
+            let endPosition = @toLength(splitter.lastIndex);
+            // ii. Let e be min(e, size).
+            endPosition = (endPosition &lt;= size) ? endPosition : size;
+            // iii. If e = p, let q be AdvanceStringIndex(S, q, unicodeMatching).
+            if (endPosition === position)
+                matchPosition = @advanceStringIndex(str, matchPosition, unicodeMatching);
+            // iv. Else e != p,
+            else {
+                // 1. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through q (exclusive).
+                let subStr = @stringSubstrInternal.@call(str, position, matchPosition - position);
+                // 2. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+                // 3. Let lengthA be lengthA + 1.
+                @putByValDirect(result, result.length, subStr);
+                // 4. If lengthA = lim, return A.
+                if (result.length == limit)
+                    return result;
+
+                // 5. Let p be e.
+                position = endPosition;
+                // 6. Let numberOfCaptures be ? ToLength(? Get(z, &quot;length&quot;)).
+                // 7. Let numberOfCaptures be max(numberOfCaptures-1, 0).
+                let numberOfCaptures = matches.length &gt; 1 ? matches.length - 1 : 0;
+
+                // 8. Let i be 1.
+                let i = 1;
+                // 9. Repeat, while i &lt;= numberOfCaptures,
+                while (i &lt;= numberOfCaptures) {
+                    // a. Let nextCapture be ? Get(z, ! ToString(i)).
+                    let nextCapture = matches[i];
+                    // b. Perform ! CreateDataProperty(A, ! ToString(lengthA), nextCapture).
+                    // d. Let lengthA be lengthA + 1.
+                    @putByValDirect(result, result.length, nextCapture);
+                    // e. If lengthA = lim, return A.
+                    if (result.length == limit)
+                        return result;
+                    // c. Let i be i + 1.
+                    i++;
+                }
+                // 10. Let q be p.
+                matchPosition = position;
+            }
+        }
+    }
+    // 20. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through size (exclusive).
+    let remainingStr = @stringSubstrInternal.@call(str, position, size);
+    // 21. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+    @putByValDirect(result, result.length, remainingStr);
+    // 22. Return A.
+    return result;
+}
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsStringPrototypejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/StringPrototype.js (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/StringPrototype.js        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/builtins/StringPrototype.js        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -125,3 +125,22 @@
</span><span class="cx"> 
</span><span class="cx">     return @repeatSlowPath(string, count);
</span><span class="cx"> }
</span><ins>+
+function split(separator, limit)
+{
+    &quot;use strict&quot;;
+    
+    if (this == null) {
+        if (this === null)
+            throw new @TypeError(&quot;String.prototype.split requires that |this| not be null&quot;);
+        throw new @TypeError(&quot;String.prototype.split requires that |this| not be undefined&quot;);
+    }
+    
+    if (separator != null) {
+        var splitter = separator[@symbolSplit];
+        if (splitter != @undefined)
+            return splitter.@call(separator, this, limit);
+    }
+    
+    return @stringSplitFast.@call(this, separator, limit);
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistrycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -59,6 +60,7 @@
</span><span class="cx">     m_symbolMatch.set(m_vm, Symbol::create(m_vm, static_cast&lt;SymbolImpl&amp;&gt;(*m_vm.propertyNames-&gt;matchSymbol.impl())));
</span><span class="cx">     m_symbolSearch.set(m_vm, Symbol::create(m_vm, static_cast&lt;SymbolImpl&amp;&gt;(*m_vm.propertyNames-&gt;searchSymbol.impl())));
</span><span class="cx">     m_symbolSpecies.set(m_vm, Symbol::create(m_vm, static_cast&lt;SymbolImpl&amp;&gt;(*m_vm.propertyNames-&gt;speciesSymbol.impl())));
</span><ins>+    m_symbolSplit.set(m_vm, Symbol::create(m_vm, static_cast&lt;SymbolImpl&amp;&gt;(*m_vm.propertyNames-&gt;splitSymbol.impl())));
</ins><span class="cx">     m_GeneratorResumeModeNormal.set(m_vm, jsNumber(static_cast&lt;int32_t&gt;(JSGeneratorFunction::GeneratorResumeMode::NormalMode)));
</span><span class="cx">     m_GeneratorResumeModeThrow.set(m_vm, jsNumber(static_cast&lt;int32_t&gt;(JSGeneratorFunction::GeneratorResumeMode::ThrowMode)));
</span><span class="cx">     m_GeneratorResumeModeReturn.set(m_vm, jsNumber(static_cast&lt;int32_t&gt;(JSGeneratorFunction::GeneratorResumeMode::ReturnMode)));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -61,6 +62,7 @@
</span><span class="cx">     macro(symbolMatch) \
</span><span class="cx">     macro(symbolSearch) \
</span><span class="cx">     macro(symbolSpecies) \
</span><ins>+    macro(symbolSplit) \
</ins><span class="cx">     macro(GeneratorResumeModeNormal) \
</span><span class="cx">     macro(GeneratorResumeModeThrow) \
</span><span class="cx">     macro(GeneratorResumeModeReturn) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonIdentifiersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -309,7 +309,6 @@
</span><span class="cx"> 
</span><span class="cx"> #define JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL_NOT_IMPLEMENTED_YET(macro)\
</span><span class="cx">     macro(replace) \
</span><del>-    macro(split)
</del><span class="cx"> 
</span><span class="cx"> #define JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(macro) \
</span><span class="cx">     macro(hasInstance) \
</span><span class="lines">@@ -318,6 +317,7 @@
</span><span class="cx">     macro(match) \
</span><span class="cx">     macro(search) \
</span><span class="cx">     macro(species) \
</span><ins>+    macro(split) \
</ins><span class="cx">     macro(toPrimitive) \
</span><span class="cx">     macro(toStringTag) \
</span><span class="cx">     macro(unscopables)
</span><span class="lines">@@ -414,6 +414,8 @@
</span><span class="cx">     macro(isArray) \
</span><span class="cx">     macro(isJSArray) \
</span><span class="cx">     macro(isArrayConstructor) \
</span><ins>+    macro(isConstructor) \
+    macro(isRegExp) \
</ins><span class="cx">     macro(concatMemcpy) \
</span><span class="cx">     macro(appendMemcpy) \
</span><span class="cx">     macro(predictFinalLengthFromArgumunts) \
</span><span class="lines">@@ -425,8 +427,18 @@
</span><span class="cx">     macro(setIteratorNext) \
</span><span class="cx">     macro(MapIterator) \
</span><span class="cx">     macro(mapIteratorNext) \
</span><ins>+    macro(regExpProtoFlagsGetter) \
+    macro(regExpProtoGlobalGetter) \
+    macro(regExpProtoIgnoreCaseGetter) \
+    macro(regExpProtoMultilineGetter) \
+    macro(regExpProtoSourceGetter) \
+    macro(regExpProtoStickyGetter) \
+    macro(regExpProtoUnicodeGetter) \
+    macro(regExpSplitFast) \
+    macro(stringIncludesInternal) \
+    macro(stringSplitFast) \
+    macro(stringSubstrInternal) \
</ins><span class="cx"> 
</span><del>-
</del><span class="cx"> namespace JSC {
</span><span class="cx">     
</span><span class="cx">     class BuiltinNames;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeECMAScriptSpecInternalFunctionscpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.cpp (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.cpp        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,49 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;ECMAScriptSpecInternalFunctions.h&quot;
+
+#include &quot;CallFrame.h&quot;
+#include &quot;ConstructData.h&quot;
+#include &quot;JSCJSValueInlines.h&quot;
+#include &quot;ProxyObject.h&quot;
+#include &quot;RegExpObject.h&quot;
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL esSpecIsConstructor(ExecState* exec)
+{
+    bool isConstructor = exec-&gt;argument(0).isConstructor();
+    return JSValue::encode(jsBoolean(isConstructor));
+}
+
+EncodedJSValue JSC_HOST_CALL esSpecIsRegExp(ExecState* exec)
+{
+    bool isRegExp = exec-&gt;argument(0).inherits(RegExpObject::info());
+    return JSValue::encode(jsBoolean(isRegExp));
+}
+
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeECMAScriptSpecInternalFunctionsh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.h (0 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/ECMAScriptSpecInternalFunctions.h        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -0,0 +1,38 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ECMAScriptSpecInternalFunctions_h
+#define ECMAScriptSpecInternalFunctions_h
+
+#include &quot;JSCJSValue.h&quot;
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL esSpecIsConstructor(ExecState*);
+EncodedJSValue JSC_HOST_CALL esSpecIsRegExp(ExecState*);
+
+} // namespace JSC
+
+#endif // ECMAScriptSpecInternalFunctions_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -45,6 +45,7 @@
</span><span class="cx"> #include &quot;Debugger.h&quot;
</span><span class="cx"> #include &quot;DebuggerScope.h&quot;
</span><span class="cx"> #include &quot;DirectArguments.h&quot;
</span><ins>+#include &quot;ECMAScriptSpecInternalFunctions.h&quot;
</ins><span class="cx"> #include &quot;Error.h&quot;
</span><span class="cx"> #include &quot;ErrorConstructor.h&quot;
</span><span class="cx"> #include &quot;ErrorPrototype.h&quot;
</span><span class="lines">@@ -256,6 +257,15 @@
</span><span class="cx">     m_globalThis.set(vm, this, globalThis);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+
+static JSObject* getGetterById(ExecState* exec, JSObject* base, const Identifier&amp; ident)
+{
+    JSValue baseValue = JSValue(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+    baseValue.getPropertySlot(exec, ident, slot);
+    return slot.getPureResult().toObject(exec);
+}
+
</ins><span class="cx"> void JSGlobalObject::init(VM&amp; vm)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(vm.currentThreadIsHoldingAPILock());
</span><span class="lines">@@ -547,6 +557,14 @@
</span><span class="cx">     JSFunction* privateFuncAppendMemcpy = JSFunction::create(vm, this, 0, String(), arrayProtoPrivateFuncAppendMemcpy);
</span><span class="cx">     JSFunction* privateFuncConcatSlowPath = JSFunction::createBuiltinFunction(vm, arrayPrototypeConcatSlowPathCodeGenerator(vm), this);
</span><span class="cx"> 
</span><ins>+    JSObject* regExpProtoFlagsGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames-&gt;flags);
+    JSObject* regExpProtoGlobalGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames-&gt;global);
+    JSObject* regExpProtoIgnoreCaseGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames-&gt;ignoreCase);
+    JSObject* regExpProtoMultilineGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames-&gt;multiline);
+    JSObject* regExpProtoSourceGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames-&gt;source);
+    JSObject* regExpProtoStickyGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames-&gt;sticky);
+    JSObject* regExpProtoUnicodeGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames-&gt;unicode);
+    
</ins><span class="cx">     GlobalPropertyInfo staticGlobals[] = {
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;NaN, jsNaN(), DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;Infinity, jsNumber(std::numeric_limits&lt;double&gt;::infinity()), DontEnum | DontDelete | ReadOnly),
</span><span class="lines">@@ -605,7 +623,6 @@
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().promiseReactionJobPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsPromiseReactionJobCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().promiseResolveThenableJobPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsPromiseResolveThenableJobCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().InspectorInstrumentationPrivateName(), InspectorInstrumentationObject::create(vm, this, InspectorInstrumentationObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum | DontDelete | ReadOnly),
</span><del>-        GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().advanceStringIndexUnicodePrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeAdvanceStringIndexUnicodeCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
</del><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;MapPrivateName, mapConstructor, DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().generatorResumePrivateName(), JSFunction::createBuiltinFunction(vm, generatorPrototypeGeneratorResumeCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().thisTimeValuePrivateName(), privateFuncThisTimeValue, DontEnum | DontDelete | ReadOnly),
</span><span class="lines">@@ -616,7 +633,29 @@
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().NumberFormatPrivateName(), intl-&gt;getDirect(vm, vm.propertyNames-&gt;NumberFormat), DontEnum | DontDelete | ReadOnly),
</span><span class="cx"> #endif // ENABLE(INTL)
</span><span class="cx"> 
</span><ins>+        GlobalPropertyInfo(vm.propertyNames-&gt;isConstructorPrivateName, JSFunction::create(vm, this, 1, String(), esSpecIsConstructor, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;isRegExpPrivateName, JSFunction::create(vm, this, 1, String(), esSpecIsRegExp, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().speciesConstructorPrivateName(), JSFunction::createBuiltinFunction(vm, globalObjectSpeciesConstructorCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpProtoFlagsGetterPrivateName, regExpProtoFlagsGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpProtoGlobalGetterPrivateName, regExpProtoGlobalGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpProtoIgnoreCaseGetterPrivateName, regExpProtoIgnoreCaseGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpProtoMultilineGetterPrivateName, regExpProtoMultilineGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpProtoSourceGetterPrivateName, regExpProtoSourceGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpProtoStickyGetterPrivateName, regExpProtoStickyGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpProtoUnicodeGetterPrivateName, regExpProtoUnicodeGetterObject, DontEnum | DontDelete | ReadOnly),
+
+        // RegExp.prototype helpers.
</ins><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;regExpCreatePrivateName, JSFunction::create(vm, this, 2, String(), esSpecRegExpCreate, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
</span><ins>+        GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().hasObservableSideEffectsForRegExpSplitPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeHasObservableSideEffectsForRegExpSplitCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().advanceStringIndexPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeAdvanceStringIndexCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().regExpExecPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeRegExpExecCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;regExpSplitFastPrivateName, JSFunction::create(vm, this, 2, String(), regExpProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
+
+        // String.prototype helpers.
+        GlobalPropertyInfo(vm.propertyNames-&gt;stringIncludesInternalPrivateName, JSFunction::create(vm, this, 1, String(), builtinStringIncludesInternal), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;stringSplitFastPrivateName, JSFunction::create(vm, this, 2, String(), stringProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;stringSubstrInternalPrivateName, JSFunction::create(vm, this, 2, String(), builtinStringSubstrInternal), DontEnum | DontDelete | ReadOnly),
</ins><span class="cx">     };
</span><span class="cx">     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertyDescriptorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -114,7 +114,6 @@
</span><span class="cx"> void PropertyDescriptor::setDescriptor(JSValue value, unsigned attributes)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(value);
</span><del>-    ASSERT(value.isGetterSetter() == !!(attributes &amp; Accessor));
</del><span class="cx"> 
</span><span class="cx">     m_attributes = attributes;
</span><span class="cx">     if (value.isGetterSetter()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpObject.h (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpObject.h        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/RegExpObject.h        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2003, 2007, 2008, 2012, 2016 Apple Inc. All Rights Reserved.
</del><ins>+ *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -93,6 +93,8 @@
</span><span class="cx">         return OBJECT_OFFSETOF(RegExpObject, m_lastIndexIsWritable);
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    static unsigned advanceStringUnicode(String, unsigned length, unsigned currentIndex);
+
</ins><span class="cx"> protected:
</span><span class="cx">     JS_EXPORT_PRIVATE RegExpObject(VM&amp;, Structure*, RegExp*);
</span><span class="cx">     JS_EXPORT_PRIVATE void finishCreation(VM&amp;);
</span><span class="lines">@@ -104,7 +106,6 @@
</span><span class="cx">     JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
</span><span class="cx">     JS_EXPORT_PRIVATE static void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
</span><span class="cx">     JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&amp;, bool shouldThrow);
</span><del>-    unsigned advanceStringUnicode(String, unsigned, unsigned);
</del><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     MatchResult matchInline(ExecState*, JSGlobalObject*, JSString*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2003, 2007, 2008, 2016 Apple Inc. All Rights Reserved.
</del><ins>+ *  Copyright (C) 2003, 2007-2008, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -39,6 +39,7 @@
</span><span class="cx"> #include &quot;RegExpCache.h&quot;
</span><span class="cx"> #include &quot;RegExpConstructor.h&quot;
</span><span class="cx"> #include &quot;RegExpMatchesArray.h&quot;
</span><ins>+#include &quot;StringObject.h&quot;
</ins><span class="cx"> #include &quot;StringRecursionChecker.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -81,6 +82,7 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;builtinNames().matchPrivateName(), regExpProtoFuncMatchPrivate, DontEnum | DontDelete | ReadOnly, 1);
</span><span class="cx">     JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;matchSymbol, regExpPrototypeMatchCodeGenerator, DontEnum);
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;searchSymbol, regExpProtoFuncSearch, DontEnum, 1);
</span><ins>+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;splitSymbol, regExpPrototypeSplitCodeGenerator, DontEnum);
</ins><span class="cx"> 
</span><span class="cx">     JSFunction* execFunction = JSFunction::create(vm, globalObject, 1, vm.propertyNames-&gt;exec.string(), regExpProtoFuncExec, RegExpExecIntrinsic);
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;execPrivateName, execFunction, DontEnum | DontDelete | ReadOnly);
</span><span class="lines">@@ -115,7 +117,7 @@
</span><span class="cx"> {
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(RegExpObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, &quot;Builtin RegExp exec can only be called on a RegExp object&quot;);
</ins><span class="cx">     JSString* string = exec-&gt;argument(0).toStringOrNull(exec);
</span><span class="cx">     if (!string)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -452,4 +454,167 @@
</span><span class="cx">     return JSValue::encode(result ? jsNumber(result.start) : jsNumber(-1));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+static inline unsigned advanceStringIndex(String str, unsigned strSize, unsigned index, bool isUnicode)
+{
+    if (!isUnicode)
+        return ++index;
+    return RegExpObject::advanceStringUnicode(str, strSize, index);
+}
+
+// ES 21.2.5.11 RegExp.prototype[@@split](string, limit)
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState* exec)
+{
+    VM&amp; vm = exec-&gt;vm();
+
+    // 1. [handled by JS builtin] Let rx be the this value.
+    // 2. [handled by JS builtin] If Type(rx) is not Object, throw a TypeError exception.
+    JSValue thisValue = exec-&gt;thisValue();
+    RegExp* regexp = asRegExpObject(thisValue)-&gt;regExp();
+
+    // 3. [handled by JS builtin] Let S be ? ToString(string).
+    String input = exec-&gt;argument(0).toString(exec)-&gt;value(exec);
+    if (vm.exception())
+        return JSValue::encode(jsUndefined());
+    ASSERT(!input.isNull());
+
+    // 4. [handled by JS builtin] Let C be ? SpeciesConstructor(rx, %RegExp%).
+    // 5. [handled by JS builtin] Let flags be ? ToString(? Get(rx, &quot;flags&quot;)).
+    // 6. [handled by JS builtin] If flags contains &quot;u&quot;, let unicodeMatching be true.
+    // 7. [handled by JS builtin] Else, let unicodeMatching be false.
+    // 8. [handled by JS builtin] If flags contains &quot;y&quot;, let newFlags be flags.
+    // 9. [handled by JS builtin] Else, let newFlags be the string that is the concatenation of flags and &quot;y&quot;.
+    // 10. [handled by JS builtin] Let splitter be ? Construct(C, Â« rx, newFlags Â»).
+
+    // 11. Let A be ArrayCreate(0).
+    // 12. Let lengthA be 0.
+    JSArray* result = constructEmptyArray(exec, 0);
+    unsigned resultLength = 0;
+
+    // 13. If limit is undefined, let lim be 2^32-1; else let lim be ? ToUint32(limit).
+    JSValue limitValue = exec-&gt;argument(1);
+    unsigned limit = limitValue.isUndefined() ? 0xFFFFFFFFu : limitValue.toUInt32(exec);
+
+    // 14. Let size be the number of elements in S.
+    unsigned inputSize = input.length();
+
+    // 15. Let p = 0.
+    unsigned position = 0;
+
+    // 16. If lim == 0, return A.
+    if (!limit)
+        return JSValue::encode(result);
+
+    // 17. If size == 0, then
+    if (input.isEmpty()) {
+        // a. Let z be ? RegExpExec(splitter, S).
+        // b. If z is not null, return A.
+        // c. Perform ! CreateDataProperty(A, &quot;0&quot;, S).
+        // d. Return A.
+        if (!regexp-&gt;match(vm, input, 0))
+            result-&gt;putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
+        return JSValue::encode(result);
+    }
+
+    // 18. Let q = p.
+    unsigned matchPosition = position;
+    // 19. Repeat, while q &lt; size
+    bool regExpIsSticky = regexp-&gt;sticky();
+    bool regExpIsUnicode = regexp-&gt;unicode();
+    while (matchPosition &lt; inputSize) {
+        Vector&lt;int, 32&gt; ovector;
+
+        // a. Perform ? Set(splitter, &quot;lastIndex&quot;, q, true).
+        // b. Let z be ? RegExpExec(splitter, S).
+        int mpos = regexp-&gt;match(vm, input, matchPosition, ovector);
+
+        // c. If z is null, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (mpos &lt; 0) {
+            if (!regExpIsSticky)
+                break;
+            matchPosition = advanceStringIndex(input, inputSize, matchPosition, regExpIsUnicode);
+            continue;
+        }
+        if (static_cast&lt;unsigned&gt;(mpos) &gt;= inputSize) {
+            // The spec redoes the RegExpExec starting at the next character of the input.
+            // But in our case, mpos &lt; 0 means that the native regexp already searched all permutations
+            // and know that we won't be able to find a match for the separator even if we redo the
+            // RegExpExec starting at the next character of the input. So, just bail.
+            break;
+        }
+
+        // d. Else, z is not null
+        //    i. Let e be ? ToLength(? Get(splitter, &quot;lastIndex&quot;)).
+        //   ii. Let e be min(e, size).
+        matchPosition = mpos;
+        unsigned matchEnd = ovector[1];
+
+        //  iii. If e = p, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (matchEnd == position) {
+            matchPosition = advanceStringIndex(input, inputSize, matchPosition, regExpIsUnicode);
+            continue;
+        }
+        // if matchEnd == 0 then position should also be zero and thus matchEnd should equal position.
+        ASSERT(matchEnd);
+
+        //   iv. Else e != p,
+        {
+            unsigned numberOfCaptures = regexp-&gt;numSubpatterns();
+            unsigned newResultLength = resultLength + numberOfCaptures + 1;
+            if (newResultLength &lt; numberOfCaptures || newResultLength &gt;= MAX_STORAGE_VECTOR_INDEX) {
+                // Let's consider what's best for users here. We're about to increase the length of
+                // the split array beyond the maximum length that we can support efficiently. This
+                // will cause us to use a HashMap for the new entries after this point. That's going
+                // to result in a very long running time of this function and very large memory
+                // usage. In my experiments, JSC will sit spinning for minutes after getting here and
+                // it was using &gt;4GB of memory and eventually grew to 8GB. It kept running without
+                // finishing until I killed it. That's probably not what the user wanted. The user,
+                // or the program that the user is running, probably made a mistake by calling this
+                // method in such a way that it resulted in such an obnoxious array. Therefore, to
+                // protect ourselves, we bail at this point.
+                throwOutOfMemoryError(exec);
+                return JSValue::encode(jsUndefined());
+            }
+
+            // 1. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through q (exclusive).
+            // 2. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+            result-&gt;putDirectIndex(exec, resultLength, jsSubstring(exec, thisValue, input, position, matchPosition - position));
+
+            // 3. Let lengthA be lengthA + 1.
+            // 4. If lengthA = lim, return A.
+            if (++resultLength == limit)
+                return JSValue::encode(result);
+
+            // 5. Let p be e.
+            position = matchEnd;
+
+            // 6. Let numberOfCaptures be ? ToLength(? Get(z, &quot;length&quot;)).
+            // 7. Let numberOfCaptures be max(numberOfCaptures-1, 0).
+            // 8. Let i be 1.
+            // 9. Repeat, while i &lt;= numberOfCaptures,
+            for (unsigned i = 1; i &lt;= numberOfCaptures; ++i) {
+                // a. Let nextCapture be ? Get(z, ! ToString(i)).
+                // b. Perform ! CreateDataProperty(A, ! ToString(lengthA), nextCapture).
+                int sub = ovector[i * 2];
+                result-&gt;putDirectIndex(exec, resultLength, sub &lt; 0 ? jsUndefined() : jsSubstring(exec, thisValue, input, sub, ovector[i * 2 + 1] - sub));
+
+                // c. Let i be i + 1.
+                // d. Let lengthA be lengthA + 1.
+                // e. If lengthA = lim, return A.
+                if (++resultLength == limit)
+                    return JSValue::encode(result);
+            }
+
+            // 10. Let q be p.
+            matchPosition = position;
+        }
+    }
+
+    // 20. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through size (exclusive).
+    // 21. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+    result-&gt;putDirectIndex(exec, resultLength++, jsSubstring(exec, thisValue, input, position, inputSize - position));
+
+    // 22. Return A.
+    return JSValue::encode(result);
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -58,6 +58,8 @@
</span><span class="cx">     WriteBarrier&lt;RegExp&gt; m_emptyRegExp;
</span><span class="cx"> };
</span><span class="cx"> 
</span><ins>+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState*);
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span><span class="cx"> #endif // RegExpPrototype_h
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringObject.h (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringObject.h        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/StringObject.h        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2007-2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -81,6 +81,29 @@
</span><span class="cx"> 
</span><span class="cx"> JS_EXPORT_PRIVATE StringObject* constructString(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="cx"> 
</span><ins>+// Helper for producing a JSString for 'string', where 'string' was been produced by
+// calling ToString on 'originalValue'. In cases where 'originalValue' already was a
+// string primitive we can just use this, otherwise we need to allocate a new JSString.
+static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue, const String&amp; string)
+{
+    if (originalValue.isString()) {
+        ASSERT(asString(originalValue)-&gt;value(exec) == string);
+        return asString(originalValue);
+    }
+    return jsString(exec, string);
+}
+
+// Helper that tries to use the JSString substring sharing mechanism if 'originalValue' is a JSString.
+static inline JSString* jsSubstring(ExecState* exec, JSValue originalValue, const String&amp; string, unsigned offset, unsigned length)
+{
+    if (originalValue.isString()) {
+        ASSERT(asString(originalValue)-&gt;value(exec) == string);
+        return jsSubstring(exec, asString(originalValue), offset, length);
+    }
+    return jsSubstring(exec, string, offset, length);
+}
+
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span><span class="cx"> #endif // StringObject_h
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004-2008, 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2009 Torch Mobile, Inc.
</span><span class="cx">  *  Copyright (C) 2015 Jordan Harband (ljharb@gmail.com)
</span><span class="cx">  *
</span><span class="lines">@@ -70,7 +70,6 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncPadStart(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState*);
</span><del>-EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState*);
</del><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState*);
</span><span class="lines">@@ -113,6 +112,7 @@
</span><span class="cx">     match     JSBuiltin    DontEnum|Function 1
</span><span class="cx">     repeat    JSBuiltin    DontEnum|Function 1
</span><span class="cx">     search    JSBuiltin    DontEnum|Function 1
</span><ins>+    split     JSBuiltin    DontEnum|Function 1
</ins><span class="cx"> @end
</span><span class="cx"> */
</span><span class="cx"> 
</span><span class="lines">@@ -139,7 +139,6 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;padStart&quot;, stringProtoFuncPadStart, DontEnum, 1);
</span><span class="cx">     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(&quot;replace&quot;, stringProtoFuncReplace, DontEnum, 2, StringPrototypeReplaceIntrinsic);
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;slice&quot;, stringProtoFuncSlice, DontEnum, 2);
</span><del>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;split&quot;, stringProtoFuncSplit, DontEnum, 2);
</del><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;substr&quot;, stringProtoFuncSubstr, DontEnum, 2);
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;substring&quot;, stringProtoFuncSubstring, DontEnum, 2);
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;toLowerCase&quot;, stringProtoFuncToLowerCase, DontEnum, 0);
</span><span class="lines">@@ -195,28 +194,6 @@
</span><span class="cx"> 
</span><span class="cx"> // ------------------------------ Functions --------------------------
</span><span class="cx"> 
</span><del>-// Helper for producing a JSString for 'string', where 'string' was been produced by
-// calling ToString on 'originalValue'. In cases where 'originalValue' already was a
-// string primitive we can just use this, otherwise we need to allocate a new JSString.
-static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue, const String&amp; string)
-{
-    if (originalValue.isString()) {
-        ASSERT(asString(originalValue)-&gt;value(exec) == string);
-        return asString(originalValue);
-    }
-    return jsString(exec, string);
-}
-
-// Helper that tries to use the JSString substring sharing mechanism if 'originalValue' is a JSString.
-static inline JSString* jsSubstring(ExecState* exec, JSValue originalValue, const String&amp; string, unsigned offset, unsigned length)
-{
-    if (originalValue.isString()) {
-        ASSERT(asString(originalValue)-&gt;value(exec) == string);
-        return jsSubstring(exec, asString(originalValue), offset, length);
-    }
-    return jsSubstring(exec, string, offset, length);
-}
-
</del><span class="cx"> static NEVER_INLINE String substituteBackreferencesSlow(StringView replacement, StringView source, const int* ovector, RegExp* reg, size_t i)
</span><span class="cx"> {
</span><span class="cx">     StringBuilder substitutedReplacement;
</span><span class="lines">@@ -1181,169 +1158,58 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// ES 5.1 - 15.5.4.14 String.prototype.split (separator, limit)
-EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
</del><ins>+// ES 21.1.3.17 String.prototype.split(separator, limit)
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSplitFast(ExecState* exec)
</ins><span class="cx"> {
</span><del>-    // 1. Call CheckObjectCoercible passing the this value as its argument.
</del><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><del>-    if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
</del><ins>+    ASSERT(checkObjectCoercible(thisValue));
</ins><span class="cx"> 
</span><del>-    // 2. Let S be the result of calling ToString, giving it the this value as its argument.
-    // 6. Let s be the number of characters in S.
</del><ins>+    // 3. Let S be the result of calling ToString, giving it the this value as its argument.
+    // 7. Let s be the number of characters in S.
</ins><span class="cx">     String input = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     ASSERT(!input.isNull());
</span><span class="cx"> 
</span><del>-    // 3. Let A be a new array created as if by the expression new Array()
</del><ins>+    // 4. Let A be a new array created as if by the expression new Array()
</ins><span class="cx">     //    where Array is the standard built-in constructor with that name.
</span><span class="cx">     JSArray* result = constructEmptyArray(exec, 0);
</span><span class="cx"> 
</span><del>-    // 4. Let lengthA be 0.
</del><ins>+    // 5. Let lengthA be 0.
</ins><span class="cx">     unsigned resultLength = 0;
</span><span class="cx"> 
</span><del>-    // 5. If limit is undefined, let lim = 2^32-1; else let lim = ToUint32(limit).
-    JSValue limitValue = exec-&gt;argument(1);
</del><ins>+    // 6. If limit is undefined, let lim = 2^32-1; else let lim = ToUint32(limit).
+    JSValue limitValue = exec-&gt;uncheckedArgument(1);
</ins><span class="cx">     unsigned limit = limitValue.isUndefined() ? 0xFFFFFFFFu : limitValue.toUInt32(exec);
</span><span class="cx"> 
</span><del>-    // 7. Let p = 0.
</del><ins>+    // 8. Let p = 0.
</ins><span class="cx">     size_t position = 0;
</span><span class="cx"> 
</span><del>-    // 8. If separator is a RegExp object (its [[Class]] is &quot;RegExp&quot;), let R = separator;
</del><ins>+    // 9. If separator is a RegExp object (its [[Class]] is &quot;RegExp&quot;), let R = separator;
</ins><span class="cx">     //    otherwise let R = ToString(separator).
</span><del>-    JSValue separatorValue = exec-&gt;argument(0);
-    if (separatorValue.inherits(RegExpObject::info())) {
-        VM* vm = &amp;exec-&gt;vm();
-        RegExp* reg = asRegExpObject(separatorValue)-&gt;regExp();
-
-        // 9. If lim == 0, return A.
-        if (!limit)
-            return JSValue::encode(result);
-
-        // 10. If separator is undefined, then
-        if (separatorValue.isUndefined()) {
-            // a. Call the [[DefineOwnProperty]] internal method of A with arguments &quot;0&quot;,
-            //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result-&gt;putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
-            // b. Return A.
-            return JSValue::encode(result);
-        }
-
-        // 11. If s == 0, then
-        if (input.isEmpty()) {
-            // a. Call SplitMatch(S, 0, R) and let z be its MatchResult result.
-            // b. If z is not failure, return A.
-            // c. Call the [[DefineOwnProperty]] internal method of A with arguments &quot;0&quot;,
-            //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            // d. Return A.
-            if (!reg-&gt;match(*vm, input, 0))
-                result-&gt;putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
-            return JSValue::encode(result);
-        }
-
-        // 12. Let q = p.
-        size_t matchPosition = 0;
-        // 13. Repeat, while q != s
-        while (matchPosition &lt; input.length()) {
-            // a. Call SplitMatch(S, q, R) and let z be its MatchResult result.
-            Vector&lt;int, 32&gt; ovector;
-            int mpos = reg-&gt;match(*vm, input, matchPosition, ovector);
-
-            // b. If z is a failure then we can break because there are no matches
-            if (mpos &lt; 0)
-                break;
-            matchPosition = mpos;
-
-            // if the match is the empty match at the end, break.
-            if (matchPosition &gt;= input.length())
-                break;
-
-            // c. Else, z is not failure
-            // i. z must be a State. Let e be z's endIndex and let cap be z's captures array.
-            size_t matchEnd = ovector[1];
-
-            // ii. If e == p, then let q = q + 1.
-            if (matchEnd == position) {
-                ++matchPosition;
-                continue;
-            }
-            // iii. if matchEnd == 0 then position should also be zero and thus matchEnd should equal position.
-            ASSERT(matchEnd);
-
-            // iii. Else, e != p
-
-            // 1. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
-            //    through q (exclusive).
-            // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
-            //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result-&gt;putDirectIndex(exec, resultLength, jsSubstring(exec, thisValue, input, position, matchPosition - position));
-
-            // 3. Increment lengthA by 1.
-            // 4. If lengthA == lim, return A.
-            ++resultLength;
-            if (resultLength == limit)
-                return JSValue::encode(result);
-            if (resultLength &gt;= MAX_STORAGE_VECTOR_INDEX) {
-                // Let's consider what's best for users here. We're about to increase the length of
-                // the split array beyond the maximum length that we can support efficiently. This
-                // will cause us to use a HashMap for the new entries after this point. That's going
-                // to result in a very long running time of this function and very large memory
-                // usage. In my experiments, JSC will sit spinning for minutes after getting here and
-                // it was using &gt;4GB of memory and eventually grew to 8GB. It kept running without
-                // finishing until I killed it. That's probably not what the user wanted. The user,
-                // or the program that the user is running, probably made a mistake by calling this
-                // method in such a way that it resulted in such an obnoxious array. Therefore, to
-                // protect ourselves, we bail at this point.
-                throwOutOfMemoryError(exec);
-                return JSValue::encode(jsUndefined());
-            }
-
-            // 5. Let p = e.
-            // 8. Let q = p.
-            position = matchEnd;
-            matchPosition = matchEnd;
-
-            // 6. Let i = 0.
-            // 7. Repeat, while i is not equal to the number of elements in cap.
-            //  a Let i = i + 1.
-            for (unsigned i = 1; i &lt;= reg-&gt;numSubpatterns(); ++i) {
-                // b Call the [[DefineOwnProperty]] internal method of A with arguments
-                //   ToString(lengthA), Property Descriptor {[[Value]]: cap[i], [[Writable]]:
-                //   true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-                int sub = ovector[i * 2];
-                result-&gt;putDirectIndex(exec, resultLength, sub &lt; 0 ? jsUndefined() : jsSubstring(exec, thisValue, input, sub, ovector[i * 2 + 1] - sub));
-                // c Increment lengthA by 1.
-                // d If lengthA == lim, return A.
-                if (++resultLength == limit)
-                    return JSValue::encode(result);
-            }
-        }
-    } else {
</del><ins>+    JSValue separatorValue = exec-&gt;uncheckedArgument(0);
+    { // FIXME: Keeping this indentation here to minimize the diff. Will unindent and remove this later.
</ins><span class="cx">         String separator = separatorValue.toString(exec)-&gt;value(exec);
</span><span class="cx">         if (exec-&gt;hadException())
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><del>-        // 9. If lim == 0, return A.
</del><ins>+        // 10. If lim == 0, return A.
</ins><span class="cx">         if (!limit)
</span><span class="cx">             return JSValue::encode(result);
</span><span class="cx"> 
</span><del>-        // 10. If separator is undefined, then
-        JSValue separatorValue = exec-&gt;argument(0);
</del><ins>+        // 11. If separator is undefined, then
</ins><span class="cx">         if (separatorValue.isUndefined()) {
</span><span class="cx">             // a.  Call the [[DefineOwnProperty]] internal method of A with arguments &quot;0&quot;,
</span><del>-            //     Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
</del><span class="cx">             result-&gt;putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
</span><span class="cx">             // b.  Return A.
</span><span class="cx">             return JSValue::encode(result);
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        // 11. If s == 0, then
</del><ins>+        // 12. If s == 0, then
</ins><span class="cx">         if (input.isEmpty()) {
</span><del>-            // a. Call SplitMatch(S, 0, R) and let z be its MatchResult result.
-            // b. If z is not failure, return A.
-            // c. Call the [[DefineOwnProperty]] internal method of A with arguments &quot;0&quot;,
-            //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
</del><ins>+            // a. Let z be SplitMatch(S, 0, R) where S is input, R is separator.
+            // b. If z is not false, return A.
+            // c. Call CreateDataProperty(A, &quot;0&quot;, S).
</ins><span class="cx">             // d. Return A.
</span><span class="cx">             if (!separator.isEmpty())
</span><span class="cx">                 result-&gt;putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
</span><span class="lines">@@ -1386,17 +1252,16 @@
</span><span class="cx">                     return JSValue::encode(result);
</span><span class="cx">             }
</span><span class="cx">         } else {
</span><del>-            // 12. Let q = p.
</del><ins>+            // 13. Let q = p.
</ins><span class="cx">             size_t matchPosition;
</span><del>-            // 13. Repeat, while q != s
-            //   a. Call SplitMatch(S, q, R) and let z be its MatchResult result.
-            //   b. If z is failure, then let q = q+1.
-            //   c. Else, z is not failure
</del><ins>+            // 14. Repeat, while q != s
+            //   a. let e be SplitMatch(S, q, R).
+            //   b. If e is failure, then let q = q+1.
+            //   c. Else, e is an integer index &lt;= s.
</ins><span class="cx">             while ((matchPosition = stringImpl-&gt;find(separatorImpl, position)) != notFound) {
</span><span class="cx">                 // 1. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
</span><span class="cx">                 //    through q (exclusive).
</span><del>-                // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
-                //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
</del><ins>+                // 2. Call CreateDataProperty(A, ToString(lengthA), T).
</ins><span class="cx">                 result-&gt;putDirectIndex(exec, resultLength, jsSubstring(exec, thisValue, input, position, matchPosition - position));
</span><span class="cx">                 // 3. Increment lengthA by 1.
</span><span class="cx">                 // 4. If lengthA == lim, return A.
</span><span class="lines">@@ -1404,19 +1269,18 @@
</span><span class="cx">                     return JSValue::encode(result);
</span><span class="cx"> 
</span><span class="cx">                 // 5. Let p = e.
</span><del>-                // 8. Let q = p.
</del><ins>+                // 6. Let q = p.
</ins><span class="cx">                 position = matchPosition + separator.length();
</span><span class="cx">             }
</span><span class="cx">         }
</span><del>-    }
</del><ins>+    } // FIXME: Keeping this indentation here to minimize the diff. Will unindent and remove this later.
</ins><span class="cx"> 
</span><del>-    // 14. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
</del><ins>+    // 15. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
</ins><span class="cx">     //     through s (exclusive).
</span><del>-    // 15. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA), Property Descriptor
-    //     {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
</del><ins>+    // 16. Call CreateDataProperty(A, ToString(lengthA), T).
</ins><span class="cx">     result-&gt;putDirectIndex(exec, resultLength++, jsSubstring(exec, thisValue, input, position, input.length() - position));
</span><span class="cx"> 
</span><del>-    // 16. Return A.
</del><ins>+    // 17. Return A.
</ins><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1459,6 +1323,23 @@
</span><span class="cx">     return JSValue::encode(jsSubstring(exec, uString, substringStart, substringLength));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+EncodedJSValue JSC_HOST_CALL builtinStringSubstrInternal(ExecState* exec)
+{
+    // @substrInternal should not have any observable side effects (e.g. it should not call
+    // GetMethod(..., @@toPrimitive) on the thisValue).
+
+    // It is ok to use the default stringProtoFuncSubstr as the implementation of
+    // @substrInternal because @substrInternal will only be called by builtins, which will
+    // guarantee that we only pass it a string thisValue. As a result, stringProtoFuncSubstr
+    // will not need to call toString() on the thisValue, and there will be no observable
+    // side-effects.
+#if !ASSERT_DISABLED
+    JSValue thisValue = exec-&gt;thisValue();
+    ASSERT(thisValue.isString());
+#endif
+    return stringProtoFuncSubstr(exec);
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="lines">@@ -1995,6 +1876,21 @@
</span><span class="cx">     return JSValue::encode(jsBoolean(stringToSearchIn.hasInfixEndingAt(searchString, std::min(end, length))));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+static EncodedJSValue JSC_HOST_CALL stringIncludesImpl(VM&amp; vm, ExecState* exec, String stringToSearchIn, String searchString, JSValue positionArg)
+{
+    unsigned start = 0;
+    if (positionArg.isInt32())
+        start = std::max(0, positionArg.asInt32());
+    else {
+        unsigned length = stringToSearchIn.length();
+        start = clampAndTruncateToUnsigned(positionArg.toInteger(exec), 0, length);
+        if (vm.exception())
+            return JSValue::encode(jsUndefined());
+    }
+
+    return JSValue::encode(jsBoolean(stringToSearchIn.contains(searchString, true, start)));
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncIncludes(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="lines">@@ -2018,19 +1914,30 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     JSValue positionArg = exec-&gt;argument(1);
</span><del>-    unsigned start = 0;
-    if (positionArg.isInt32())
-        start = std::max(0, positionArg.asInt32());
-    else {
-        unsigned length = stringToSearchIn.length();
-        start = clampAndTruncateToUnsigned(positionArg.toInteger(exec), 0, length);
-        if (exec-&gt;hadException())
-            return JSValue::encode(jsUndefined());
-    }
</del><span class="cx"> 
</span><del>-    return JSValue::encode(jsBoolean(stringToSearchIn.contains(searchString, true, start)));
</del><ins>+    return stringIncludesImpl(vm, exec, stringToSearchIn, searchString, positionArg);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+EncodedJSValue JSC_HOST_CALL builtinStringIncludesInternal(ExecState* exec)
+{
+    JSValue thisValue = exec-&gt;thisValue();
+    ASSERT(checkObjectCoercible(thisValue));
+
+    String stringToSearchIn = thisValue.toString(exec)-&gt;value(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(jsUndefined());
+
+    JSValue a0 = exec-&gt;uncheckedArgument(0);
+    VM&amp; vm = exec-&gt;vm();
+    String searchString = a0.toString(exec)-&gt;value(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(jsUndefined());
+
+    JSValue positionArg = exec-&gt;argument(1);
+
+    return stringIncludesImpl(vm, exec, stringToSearchIn, searchString, positionArg);
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncIterator(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringPrototype.h (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringPrototype.h        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/runtime/StringPrototype.h        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2007, 2008, 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2007-2008, 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -66,7 +66,11 @@
</span><span class="cx"> String substituteBackreferences(const String&amp; replacement, StringView source, const int* ovector, RegExp* reg);
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncRepeatCharacter(ExecState*);
</span><ins>+EncodedJSValue JSC_HOST_CALL stringProtoFuncSplitFast(ExecState*);
</ins><span class="cx"> 
</span><ins>+EncodedJSValue JSC_HOST_CALL builtinStringSubstrInternal(ExecState*);
+EncodedJSValue JSC_HOST_CALL builtinStringIncludesInternal(ExecState*);
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span><span class="cx"> #endif // StringPrototype_h
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestses6yaml"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/es6.yaml (199730 => 199731)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/es6.yaml        2016-04-19 16:58:17 UTC (rev 199730)
+++ trunk/Source/JavaScriptCore/tests/es6.yaml        2016-04-19 17:25:20 UTC (rev 199731)
</span><span class="lines">@@ -1007,7 +1007,7 @@
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.split].js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_get_calls_RegExp_constructor.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_String.prototype.match.js
</span><span class="lines">@@ -1017,7 +1017,7 @@
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_String.prototype.search.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_String.prototype.split.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_get_calls_String.raw.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_ToPrimitive.js
</span><span class="lines">@@ -1093,7 +1093,7 @@
</span><span class="cx"> - path: es6/RegExp.prototype_properties_RegExp.prototype[Symbol.search].js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/RegExp.prototype_properties_RegExp.prototype[Symbol.split].js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/RegExp.prototype_properties_RegExp[Symbol.species].js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/RegExp_is_subclassable_correct_prototype_chain.js
</span><span class="lines">@@ -1215,9 +1215,9 @@
</span><span class="cx"> - path: es6/well-known_symbols_Symbol.species_existence.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/well-known_symbols_Symbol.species_RegExp.prototype[Symbol.split].js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/well-known_symbols_Symbol.split.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/well-known_symbols_Symbol.toPrimitive.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/well-known_symbols_Symbol.toStringTag.js
</span></span></pre>
</div>
</div>

</body>
</html>