Bug 1111164 part 4. Switch to typed reserved slot gets in String.js. r=jorendorff

js/src/builtin/String.js

@@ -189,7 +189,7 @@ function String_repeat(count) {
     return T;
 }
 
-#define STRING_ITERATOR_SLOT_ITERATED_OBJECT 0
+#define STRING_ITERATOR_SLOT_ITERATED_STRING 0
 #define STRING_ITERATOR_SLOT_NEXT_INDEX 1
 
 // ES6 draft specification, section 21.1.3.27, version 2013-09-27.
@@ -197,7 +197,7 @@ function String_iterator() {
     CheckObjectCoercible(this);
     var S = ToString(this);
     var iterator = NewStringIterator();
-    UnsafeSetReservedSlot(iterator, STRING_ITERATOR_SLOT_ITERATED_OBJECT, S);
+    UnsafeSetReservedSlot(iterator, STRING_ITERATOR_SLOT_ITERATED_STRING, S);
     UnsafeSetReservedSlot(iterator, STRING_ITERATOR_SLOT_NEXT_INDEX, 0);
     return iterator;
 }
@@ -212,8 +212,11 @@ function StringIteratorNext() {
                             "StringIteratorNext");
     }
 
-    var S = UnsafeGetReservedSlot(this, STRING_ITERATOR_SLOT_ITERATED_OBJECT);
-    var index = UnsafeGetReservedSlot(this, STRING_ITERATOR_SLOT_NEXT_INDEX);
+    var S = UnsafeGetStringFromReservedSlot(this, STRING_ITERATOR_SLOT_ITERATED_STRING);
+    // We know that JSString::MAX_LENGTH <= INT32_MAX (and assert this in
+    // SelfHostring.cpp) so our current index can never be anything other than
+    // an Int32Value.
+    var index = UnsafeGetInt32FromReservedSlot(this, STRING_ITERATOR_SLOT_NEXT_INDEX);
     var size = S.length;
     var result = { value: undefined, done: false };
 

js/src/vm/SelfHosting.cpp

@@ -1689,3 +1689,7 @@ js::IsSelfHostedFunctionWithName(JSFunction *fun, JSAtom *name)
 {
     return fun->isSelfHostedBuiltin() && fun->getExtendedSlot(0).toString() == name;
 }
+
+static_assert(JSString::MAX_LENGTH <= INT32_MAX,
+              "StringIteratorNext in builtin/String.js assumes the stored index "
+              "into the string is an Int32Value");