Fix empty-XMLList-literal basis case bug (290499, r/a=me).

js/src/jsatom.h

@@ -153,6 +153,9 @@ struct JSAtomState {
     jsatomid            number;         /* one beyond greatest atom number */
     jsatomid            liveAtoms;      /* number of live atoms after last GC */
 
+    /* The rt->emptyString atom, see jsstr.c's js_InitRuntimeStringState. */
+    JSAtom              *emptyAtom;
+
     /* Type names and value literals. */
     JSAtom              *typeAtoms[JSTYPE_LIMIT];
     JSAtom              *booleanAtoms[2];
@@ -180,8 +183,8 @@ struct JSAtomState {
     JSAtom              *classPrototypeAtom;
     JSAtom              *constructorAtom;
     JSAtom              *countAtom;
-    JSAtom              *etagoAtom;
     JSAtom              *eachAtom;
+    JSAtom              *etagoAtom;
     JSAtom              *evalAtom;
     JSAtom              *getAtom;
     JSAtom              *getterAtom;

js/src/jsemit.c

@@ -4555,15 +4555,30 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             break;
         }
 
-        JS_ASSERT(pn->pn_count != 0);
+        JS_ASSERT(pn->pn_type == TOK_XMLLIST || pn->pn_count != 0);
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             if (!js_EmitTree(cx, cg, pn2))
                 return JS_FALSE;
             if (pn2 != pn->pn_head && js_Emit1(cx, cg, JSOP_ADD) < 0)
                 return JS_FALSE;
         }
-        if ((pn->pn_extra & PNX_XMLROOT) && js_Emit1(cx, cg, pn->pn_op) < 0)
-            return JS_FALSE;
+
+        if (pn->pn_extra & PNX_XMLROOT) {
+            if (pn->pn_count == 0) {
+                JS_ASSERT(pn->pn_type == TOK_XMLLIST);
+                atom = cx->runtime->atomState.emptyAtom;
+                ale = js_IndexAtom(cx, atom, &cg->atomList);
+                if (!ale)
+                    return JS_FALSE;
+                EMIT_ATOM_INDEX_OP(JSOP_STRING, ALE_INDEX(ale));
+            }
+            if (js_Emit1(cx, cg, pn->pn_op) < 0)
+                return JS_FALSE;
+        }
+#ifdef DEBUG
+        else
+            JS_ASSERT(pn->pn_count != 0);
+#endif
         break;
 
       case TOK_XMLPTAGC:

js/src/jsparse.c

@@ -4733,7 +4733,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
       case TOK_XMLETAGO:
       case TOK_XMLNAME:
         if (pn->pn_arity == PN_LIST) {
-            JS_ASSERT(pn->pn_count != 0);
+            JS_ASSERT(pn->pn_type == TOK_XMLLIST || pn->pn_count != 0);
             if (!FoldXMLConstants(cx, pn, tc))
                 return JS_FALSE;
         }

js/src/jsscan.c

@@ -1650,16 +1650,16 @@ retry:
                     ADD_TO_TOKENBUF(c);
                 }
                 if (contentIndex < 0) {
-                    atom = js_AtomizeString(cx, cx->runtime->emptyString, 0);
+                    atom = cx->runtime->atomState.emptyAtom;
                 } else {
                     atom = js_AtomizeChars(cx,
                                            &TOKENBUF_CHAR(contentIndex),
                                            TOKENBUF_LENGTH() - contentIndex,
                                            0);
+                    if (!atom)
+                        goto error;
                     TRIM_TOKENBUF(targetLength);
                 }
-                if (!atom)
-                    goto error;
                 tp->t_atom2 = atom;
                 tt = TOK_XMLPI;
 

js/src/jsstr.c

@@ -2402,6 +2402,7 @@ js_InitRuntimeStringState(JSContext *cx)
 {
     JSRuntime *rt;
     JSString *empty;
+    JSAtom *atom;
 
     rt = cx->runtime;
     JS_ASSERT(!rt->emptyString);
@@ -2412,10 +2413,12 @@ js_InitRuntimeStringState(JSContext *cx)
         return JS_FALSE;
 
     /* Atomize it for scripts that use '' + x to convert x to string. */
-    if (!js_AtomizeString(cx, empty, ATOM_PINNED))
+    atom = js_AtomizeString(cx, empty, ATOM_PINNED);
+    if (!atom)
         return JS_FALSE;
 
     rt->emptyString = empty;
+    rt->atomState.emptyAtom = atom;
     return JS_TRUE;
 }