Backed out 2 changesets (bug 1021312, bug 1020460) for apparently causing jsreftest orange on a CLOSED TREE

Backed out changeset eca7bdeb0c6e (bug 1020460)
Backed out changeset 965578443062 (bug 1021312)

js/src/jit-test/tests/basic/array-tosource.js

@@ -1,8 +0,0 @@
-load(libdir + 'asserts.js');
-
-assertEq(Array.prototype.toSource.call([1, 'hi']), '[1, "hi"]');
-assertEq(Array.prototype.toSource.call({1: 10, 0: 42, length: 2}), "[42, 10]");
-assertEq(Array.prototype.toSource.call({1: 10, 0: 42, length: 1}), "[42]");
-assertThrowsInstanceOf(() => Array.prototype.toSource.call("someString"), TypeError);
-assertThrowsInstanceOf(() => Array.prototype.toSource.call(42), TypeError);
-assertThrowsInstanceOf(() => Array.prototype.toSource.call(undefined), TypeError);

js/src/jit-test/tests/basic/testCrossCompartmentTransparency.js

@@ -56,6 +56,7 @@ function test(str, f) {
     assertEq(threw, true);
 }
 
+test("new Array(1,2,3)", function(a) Array.prototype.toSource.call(a));
 test("new Boolean(true)", function(b) Boolean.prototype.toSource.call(b));
 test("new Boolean(true)", function(b) Boolean.prototype.toString.call(b));
 test("new Boolean(true)", function(b) Boolean.prototype.valueOf.call(b));

js/src/jsarray.cpp

@@ -850,17 +850,16 @@ AddLengthProperty(ExclusiveContext *cx, HandleObject obj)
 }
 
 #if JS_HAS_TOSOURCE
-
-static bool
-array_toSource(JSContext *cx, unsigned argc, Value *vp)
+MOZ_ALWAYS_INLINE bool
+IsArray(HandleValue v)
 {
-    JS_CHECK_RECURSION(cx, return false);
-    CallArgs args = CallArgsFromVp(argc, vp);
+    return v.isObject() && v.toObject().is<ArrayObject>();
+}
 
-    if (!args.thisv().isObject()) {
-        ReportIncompatible(cx, args);
-        return false;
-    }
+MOZ_ALWAYS_INLINE bool
+array_toSource_impl(JSContext *cx, CallArgs args)
+{
+    JS_ASSERT(IsArray(args.thisv()));
 
     Rooted<JSObject*> obj(cx, &args.thisv().toObject());
     RootedValue elt(cx);
@@ -926,6 +925,13 @@ array_toSource(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
+static bool
+array_toSource(JSContext *cx, unsigned argc, Value *vp)
+{
+    JS_CHECK_RECURSION(cx, return false);
+    CallArgs args = CallArgsFromVp(argc, vp);
+    return CallNonGenericMethod<IsArray, array_toSource_impl>(cx, args);
+}
 #endif
 
 struct EmptySeparatorOp

js/xpconnect/tests/unit/test_bug1021312.js

@@ -7,7 +7,7 @@ function run_test() {
   let sb = new Cu.Sandbox(this);
   var called = false;
 
-  Cu.exportFunction(function(str) { do_check_true(/someString/.test(str)); called = true; },
+  Cu.exportFunction(function(str) { do_check_true(str, "someString"); called = true; },
                     sb, { defineAs: "func" });
   // Do something weird with the string to make sure that it doesn't get interned.
   Cu.evalInSandbox("var str = 'someString'; for (var i = 0; i < 10; ++i) str += i;", sb);