es6.regexp.constructor polyfill moves RegExps onto slow path in V8

[schuay]

See https://medium.com/@schuay/js-regexp-fast-and-slow-d29d6b77b06 and mishoo/UglifyJS#1964 for more context.

es6.regexp.constructor (and possibly other regexp polyfills) cause all regexps to take the slow path in V8 by modifying RegExp.prototype.

Repro instructions here: mishoo/UglifyJS#1964 (comment)

Input Code

require("babel-polyfill");
var str = "fooBar";
console.log( str.split(/(?=[A-Z])/) );

Expected Behavior

RegExp.prototype remains unmodified when possible:

$ d8 --allow-natives-syntax

%DebugPrint(RegExp.prototype)
DebugPrint: 0x3abc271141d1: [JS_OBJECT_TYPE]
 - map = 0x2a00e4885ab9 [FastProperties]
 - prototype = 0x3abc27104631
 - elements = 0x215b0e102241 <FixedArray[0]> [FAST_HOLEY_ELEMENTS]
 - properties = 0x215b0e102241 <FixedArray[0]> {
    #constructor: 0x3abc27113209 <JSFunction RegExp (sfi = 0x215b0e157f71)> (const data descriptor)

// Note the value of the constructor property.

Current Behavior

RegExp.prototype.constructor is set by es6.regexp.constructor.

DebugPrint: 0x2cfbf37141d1: [JS_OBJECT_TYPE]
 - map = 0x17891b2272a1 [FastProperties]
 - prototype = 0x2cfbf3704631
 - elements = 0x3bcb3a802241 <FixedArray[0]> [FAST_HOLEY_ELEMENTS]
 - properties = 0x3bcb3a802241 <FixedArray[0]> {
    #constructor: 0x286c311dcaa9 <JSFunction $RegExp (sfi = 0x13170d6ca299)> (data field 0)

// constructor is the '$RegExp' function.

Environment

See mishoo/UglifyJS#1964
babel-polyfill@6.23.0 browserify@14.3.0 uglify-js@3.0.7

Possible fix

Avoid modifying RegExp.prototype if possible.

[babel-bot]

Hey @schuay! We really appreciate you taking the time to report an issue. The collaborators
on this project attempt to help as many people as possible, but we're a limited number of volunteers,
so it's possible this won't be addressed swiftly.

If you need any help, or just have general Babel or JavaScript questions, we have a vibrant Slack
community that typically always has someone willing to help. You can sign-up here
for an invite.

[hzoo]

Thanks for the report and article @schuay, much appreciated 😎! I mentioned in https://twitter.com/left_pad/status/866691698306539520, but at the moment babel-polyfill is basically an alias for https://github.com/zloirock/core-js (https://github.com/babel/babel/blob/7.0/packages/babel-polyfill/src/index.js) so we can move it to that repo if that's cool

[zloirock]

What can I say... It should be an issue only for old V8 versions, it should not be a problem in modern V8, and I don't see any ways for fix it.

[littledan]

Created a new bug at zloirock/core-js#306 .

[schuay]

@zloirock it also triggers on current chrome / current v8.
Let's close this one and continue discussion on the bug opened in the previous comment.