Bug 1149119 - Use Atoms in the template object hold by Baseline. r=jandem, a=abillings

This commit is contained in:
Nicolas B. Pierron
2015-04-24 16:25:41 -04:00
parent cd460ccc7d
commit ff7cd067d7
2 changed files with 14 additions and 1 deletions

View File

@@ -9490,6 +9490,17 @@ TryAttachStringSplit(JSContext* cx, ICCall_Fallback* stub, HandleScript script,
if (!CopyArray(cx, obj, &arr))
return false;
// Atomize all elements of the array.
RootedArrayObject arrObj(cx, &arr.toObject().as<ArrayObject>());
uint32_t initLength = arrObj->length();
for (uint32_t i = 0; i < initLength; i++) {
JSAtom* str = js::AtomizeString(cx, arrObj->getDenseElement(i).toString());
if (!str)
return false;
arrObj->setDenseElement(i, StringValue(str));
}
ICCall_StringSplit::Compiler compiler(cx, stub->fallbackMonitorStub()->firstMonitorStub(),
script->pcToOffset(pc), thisString, argString,
arr);

View File

@@ -1420,7 +1420,9 @@ IonBuilder::inlineConstantStringSplit(CallInfo& callInfo)
Vector<MConstant*, 0, SystemAllocPolicy> arrayValues;
for (uint32_t i = 0; i < initLength; i++) {
MConstant* value = MConstant::New(alloc(), templateObject->getDenseElement(i), constraints());
Value str = templateObject->getDenseElement(i);
MOZ_ASSERT(str.toString()->isAtom());
MConstant* value = MConstant::New(alloc(), str, constraints());
if (!TypeSetIncludes(key.maybeTypes(), value->type(), value->resultTypeSet()))
return InliningStatus_NotInlined;