Bug 1235403 - Adding flat replacement bit on StringReplace to the recover instruction. r=nbp

js/src/jit/MIR.h

@@ -7682,7 +7682,10 @@ class MStringReplace
     bool writeRecoverData(CompactBufferWriter& writer) const override;
     bool canRecoverOnBailout() const override {
         if (isFlatReplacement_)
-            return false;
+        {
+            MOZ_ASSERT(!pattern()->isRegExp());
+            return true;
+        }
         if (pattern()->isRegExp())
             return !pattern()->toRegExp()->source()->global();
         return false;

js/src/jit/Recover.cpp

@@ -1514,11 +1514,14 @@ MStringReplace::writeRecoverData(CompactBufferWriter& writer) const
 {
     MOZ_ASSERT(canRecoverOnBailout());
     writer.writeUnsigned(uint32_t(RInstruction::Recover_StringReplace));
+    writer.writeByte(isFlatReplacement_);
     return true;
 }
 
 RStringReplace::RStringReplace(CompactBufferReader& reader)
-{ }
+{
+    isFlatReplacement_ = reader.readByte();
+}
 
 bool RStringReplace::recover(JSContext* cx, SnapshotIterator& iter) const
 {
@@ -1526,7 +1529,9 @@ bool RStringReplace::recover(JSContext* cx, SnapshotIterator& iter) const
     RootedString pattern(cx, iter.read().toString());
     RootedString replace(cx, iter.read().toString());
 
-    JSString* result = js::str_replace_string_raw(cx, string, pattern, replace);
+    JSString* result = isFlatReplacement_ ? js::str_flat_replace_string(cx, string, pattern, replace) :
+                                            js::str_replace_string_raw(cx, string, pattern, replace);
+
     if (!result)
         return false;
 

js/src/jit/Recover.h

@@ -596,6 +596,9 @@ class RRegExpReplace final : public RInstruction
 
 class RStringReplace final : public RInstruction
 {
+  private:
+    bool isFlatReplacement_;
+
   public:
     RINSTRUCTION_HEADER_(StringReplace)