Bug 1459607 - CallSiteObjects can only contain strings. r=jandem, a=abillings
authorTom Schuster <evilpies@gmail.com>
Tue, 08 May 2018 22:42:54 +0200
changeset 473293 453294133297be02ae10459bf4e430ba1df039a0
parent 473292 2e4115e95bc3179250ac2f4293a531ce406d7710
child 473294 720baaffac8cf0b71e351720bc3617a508d039d1
push id1728
push userjlund@mozilla.com
push dateMon, 18 Jun 2018 21:12:27 +0000
treeherdermozilla-release@c296fde26f5f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, abillings
bugs1459607
milestone61.0
Bug 1459607 - CallSiteObjects can only contain strings. r=jandem, a=abillings
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -8266,34 +8266,39 @@ IonBuilder::getElemTryCallSiteObject(boo
 
     JSObject* cst = &obj->toConstant()->toObject();
     if (!cst->is<ArrayObject>()) {
         trackOptimizationOutcome(TrackedOutcome::GenericFailure);
         return Ok();
     }
 
     // Technically this code would work with any kind of frozen array,
-    // in pratice only CallSiteObjects can be constant and frozen.
+    // in pratice it is usually a CallSiteObject.
 
     ArrayObject* array = &cst->as<ArrayObject>();
     if (array->lengthIsWritable() || array->hasEmptyElements() || !array->denseElementsAreFrozen()) {
         trackOptimizationOutcome(TrackedOutcome::GenericFailure);
         return Ok();
     }
 
     int32_t idx = index->toConstant()->toInt32();
     if (idx < 0 || !array->containsDenseElement(uint32_t(idx))) {
         trackOptimizationOutcome(TrackedOutcome::OutOfBounds);
         return Ok();
     }
 
+    const Value& v = array->getDenseElement(uint32_t(idx));
+    // Strings should have been atomized by the parser.
+    if (!v.isString() || !v.toString()->isAtom())
+        return Ok();
+
     obj->setImplicitlyUsedUnchecked();
     index->setImplicitlyUsedUnchecked();
 
-    pushConstant(array->getDenseElement(uint32_t(idx)));
+    pushConstant(v);
 
     trackOptimizationSuccess();
     *emitted = true;
     return Ok();
 }
 
 AbortReasonOr<Ok>
 IonBuilder::getElemTryString(bool* emitted, MDefinition* obj, MDefinition* index)