Bug 1108941 - Use the template literal registry in Ion. (r=jandem)

js/src/jit/IonBuilder.cpp

@@ -2185,9 +2185,12 @@ IonBuilder::inspectOpcode(JSOp op)
         return jsop_regexp(info().getRegExp(pc));
 
       case JSOP_CALLSITEOBJ:
-        // TODO this is wrong, need threadsafe way to get unique template obj
-        pushConstant(ObjectValue(*(info().getObject(pc))));
+      {
+        JSObject* raw = script()->getObject(GET_UINT32_INDEX(pc) + 1);
+        JSObject* obj = script()->compartment()->getExistingTemplateLiteralObject(raw);
+        pushConstant(ObjectValue(*obj));
         return Ok();
+      }
 
       case JSOP_OBJECT:
         return jsop_object(info().getObject(pc));

js/src/jscompartment.cpp

@@ -657,6 +657,14 @@ JSCompartment::getTemplateLiteralObject(JSContext* cx, HandleObject rawStrings,
     return true;
 }
 
+JSObject*
+JSCompartment::getExistingTemplateLiteralObject(JSObject* rawStrings)
+{
+    TemplateRegistry::Ptr p = templateLiteralMap_.lookup(rawStrings);
+    MOZ_ASSERT(p);
+    return p->value();
+}
+
 void
 JSCompartment::traceOutgoingCrossCompartmentWrappers(JSTracer* trc)
 {

js/src/jscompartment.h

@@ -758,6 +758,9 @@ struct JSCompartment
     bool getTemplateLiteralObject(JSContext* cx, js::HandleObject rawStrings,
                                   js::MutableHandleObject templateObj);
 
+    // Per above, but an entry must already exist in the template registry.
+    JSObject* getExistingTemplateLiteralObject(JSObject* rawStrings);
+
     void findOutgoingEdges(js::gc::ZoneComponentFinder& finder);
 
     MOZ_MUST_USE bool findDeadProxyZoneEdges(bool* foundAny);