Bug 1134074 - IonBuilder: Atomize strings when inlining String.split. r=djvj

js/src/jit-test/tests/ion/bug1134074.js

@@ -0,0 +1,10 @@
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+function bar(i) {
+  if (i >= 40)
+    return;
+  if ("aaa,bbb,ccc".split(",")[0].length != 3)
+    throw "???";
+  bar(i + 1);
+}
+bar(0);

js/src/jit/MCallOptimize.cpp

@@ -1542,9 +1542,14 @@ IonBuilder::inlineConstantStringSplit(CallInfo &callInfo)
     if (templateObject->getDenseInitializedLength() != initLength)
         return InliningStatus_NotInlined;
 
+    JSContext *cx = GetJitContext()->cx;
     Vector<MConstant *, 0, SystemAllocPolicy> arrayValues;
     for (uint32_t i = 0; i < initLength; i++) {
-        MConstant *value = MConstant::New(alloc(), templateObject->getDenseElement(i), constraints());
+        JSAtom *str = js::AtomizeString(cx, templateObject->getDenseElement(i).toString());
+        if (!str)
+            return InliningStatus_Error;
+
+        MConstant *value = MConstant::New(alloc(), StringValue(str), constraints());
         if (!TypeSetIncludes(key.maybeTypes(), value->type(), value->resultTypeSet()))
             return InliningStatus_NotInlined;
 

js/src/jit/MIR.cpp

@@ -710,6 +710,8 @@ MConstant::MConstant(const js::Value &vp, CompilerConstraintList *constraints)
         setResultTypeSet(MakeUnknownTypeSet());
     }
 
+    MOZ_ASSERT_IF(vp.isString(), vp.toString()->isAtom());
+
     setMovable();
 }