Bug 752205 - Ensure switch case strings are atoms (r=njn)

--HG--
extra : rebase_source : e91d6c4d5c078e9ae16e7d3bd80e082a564dee57

js/src/frontend/BytecodeEmitter.cpp

@@ -2468,6 +2468,14 @@ EmitSwitch(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                             switchOp = JSOP_CONDSWITCH;
                             continue;
                         }
+                        if (constVal.isString()) {
+                            JSAtom *atom = js_AtomizeString(cx, constVal.toString());
+                            if (!atom) {
+                                ok = JS_FALSE;
+                                goto release;
+                            }
+                            constVal.setString(atom);
+                        }
                         constPropagated = JS_TRUE;
                         break;
                     }

js/src/jit-test/tests/basic/testBug752205.js

@@ -0,0 +1,6 @@
+var x = "one";
+var y = "two";
+const a = x + y;
+var hit = false;
+eval('switch("onetwo") { case a: hit = true; };');
+assertEq(hit, true);