[JSC] Use jsSubstring with JSString

https://bugs.webkit.org/show_bug.cgi?id=259678
rdar://113191047

Reviewed by Mark Lam.

This patch uses more jsSubstring + JSString* form instead of jsSubstring + WTF::String form
since it can have more opportunities for optimizations including 2-characters atomizations.

* Source/JavaScriptCore/runtime/StringPrototype.cpp:
(JSC::replaceUsingRegExpSearch):
* Source/JavaScriptCore/runtime/StringPrototypeInlines.h:
(JSC::replaceUsingStringSearch):

Canonical link: https://commits.webkit.org/266481@main

Source/JavaScriptCore/runtime/StringPrototype.cpp

@@ -587,8 +587,10 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
 
                 if (matchStart < 0)
                     patternValue = jsUndefined();
-                else
-                    patternValue = jsSubstring(vm, source, matchStart, matchLen);
+                else {
+                    patternValue = jsSubstring(vm, globalObject, string, matchStart, matchLen);
+                    RETURN_IF_EXCEPTION(scope, nullptr);
+                }
 
                 cachedCall.appendArgument(patternValue);
 
@@ -605,8 +607,10 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
                             JSValue captureValue;
                             if (captureStart < 0)
                                 captureValue = jsUndefined();
-                            else
-                                captureValue = jsSubstring(vm, source, captureStart, captureLen);
+                            else {
+                                captureValue = jsSubstring(vm, globalObject, string, captureStart, captureLen);
+                                RETURN_IF_EXCEPTION(scope, nullptr);
+                            }
                             groups->putDirect(vm, Identifier::fromString(vm, groupName), captureValue);
                         } else
                             groups->putDirect(vm, Identifier::fromString(vm, groupName), jsUndefined());
@@ -669,7 +673,7 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
                     if (matchStart < 0)
                         patternValue = jsUndefined();
                     else {
-                        patternValue = jsSubstring(vm, source, matchStart, matchLen);
+                        patternValue = jsSubstring(vm, globalObject, string, matchStart, matchLen);
                         RETURN_IF_EXCEPTION(scope, nullptr);
                     }
 
@@ -689,7 +693,7 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
                                 if (captureStart < 0)
                                     captureValue = jsUndefined();
                                 else {
-                                    captureValue = jsSubstring(vm, source, captureStart, captureLen);
+                                    captureValue = jsSubstring(vm, globalObject, string, captureStart, captureLen);
                                     RETURN_IF_EXCEPTION(scope, nullptr);
                                 }
                                 groups->putDirect(vm, Identifier::fromString(vm, groupName), captureValue);

Source/JavaScriptCore/runtime/StringPrototypeInlines.h

@@ -270,7 +270,7 @@ inline JSString* replaceUsingStringSearch(VM& vm, JSGlobalObject* globalObject,
         if (callData.type != CallData::Type::None) {
             JSValue replacement;
             if (cachedCall) {
-                auto* substring = jsSubstring(vm, string, matchStart, searchStringLength);
+                auto* substring = jsSubstring(vm, globalObject, jsString, matchStart, searchStringLength);
                 RETURN_IF_EXCEPTION(scope, nullptr);
                 cachedCall->clearArguments();
                 cachedCall->appendArgument(substring);
@@ -280,7 +280,7 @@ inline JSString* replaceUsingStringSearch(VM& vm, JSGlobalObject* globalObject,
                 replacement = cachedCall->call();
             } else {
                 MarkedArgumentBuffer args;
-                auto* substring = jsSubstring(vm, string, matchStart, searchString.impl()->length());
+                auto* substring = jsSubstring(vm, globalObject, jsString, matchStart, searchString.impl()->length());
                 RETURN_IF_EXCEPTION(scope, nullptr);
                 args.append(substring);
                 args.append(jsNumber(matchStart));