Bug 1111164 part 4. Switch to typed reserved slot gets in String.js. r=jorendorff
authorBoris Zbarsky <bzbarsky@mit.edu>
Fri, 02 Jan 2015 17:08:34 -0500
changeset 247743 e27e73cca9fc6ddc3ca1b34a245aa330ae79c03c
parent 247742 96ec553f0f8fc551a4b685e1bc0f1c7652107acd
child 247744 576a73e44f6341c8385c2c7b034975d0d178dd0b
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjorendorff
bugs1111164
milestone37.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1111164 part 4. Switch to typed reserved slot gets in String.js. r=jorendorff
js/src/builtin/String.js
js/src/vm/SelfHosting.cpp
--- a/js/src/builtin/String.js
+++ b/js/src/builtin/String.js
@@ -184,41 +184,44 @@ function String_repeat(count) {
         if (n)
             S += S;
         else
             break;
     }
     return T;
 }
 
-#define STRING_ITERATOR_SLOT_ITERATED_OBJECT 0
+#define STRING_ITERATOR_SLOT_ITERATED_STRING 0
 #define STRING_ITERATOR_SLOT_NEXT_INDEX 1
 
 // ES6 draft specification, section 21.1.3.27, version 2013-09-27.
 function String_iterator() {
     CheckObjectCoercible(this);
     var S = ToString(this);
     var iterator = NewStringIterator();
-    UnsafeSetReservedSlot(iterator, STRING_ITERATOR_SLOT_ITERATED_OBJECT, S);
+    UnsafeSetReservedSlot(iterator, STRING_ITERATOR_SLOT_ITERATED_STRING, S);
     UnsafeSetReservedSlot(iterator, STRING_ITERATOR_SLOT_NEXT_INDEX, 0);
     return iterator;
 }
 
 function StringIteratorIdentity() {
     return this;
 }
 
 function StringIteratorNext() {
     if (!IsObject(this) || !IsStringIterator(this)) {
         return callFunction(CallStringIteratorMethodIfWrapped, this,
                             "StringIteratorNext");
     }
 
-    var S = UnsafeGetReservedSlot(this, STRING_ITERATOR_SLOT_ITERATED_OBJECT);
-    var index = UnsafeGetReservedSlot(this, STRING_ITERATOR_SLOT_NEXT_INDEX);
+    var S = UnsafeGetStringFromReservedSlot(this, STRING_ITERATOR_SLOT_ITERATED_STRING);
+    // We know that JSString::MAX_LENGTH <= INT32_MAX (and assert this in
+    // SelfHostring.cpp) so our current index can never be anything other than
+    // an Int32Value.
+    var index = UnsafeGetInt32FromReservedSlot(this, STRING_ITERATOR_SLOT_NEXT_INDEX);
     var size = S.length;
     var result = { value: undefined, done: false };
 
     if (index >= size) {
         result.done = true;
         return result;
     }
 
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -1684,8 +1684,12 @@ js::SelfHostedFunction(JSContext *cx, Ha
     return &func.toObject().as<JSFunction>();
 }
 
 bool
 js::IsSelfHostedFunctionWithName(JSFunction *fun, JSAtom *name)
 {
     return fun->isSelfHostedBuiltin() && fun->getExtendedSlot(0).toString() == name;
 }
+
+static_assert(JSString::MAX_LENGTH <= INT32_MAX,
+              "StringIteratorNext in builtin/String.js assumes the stored index "
+              "into the string is an Int32Value");