Bug 977966 - Replace foo.split(bar).join(baz) by foo.replace(bar, baz). r=nbp

js/src/jit-test/tests/ion/bug977966.js

@@ -31,8 +31,53 @@ function join(i) {
     return i;
 }
 
+function split_join(i) {
+    var x = (i + "-" + i).split("-").join("->");
+    assertEq(x, i + "->" + i);
+    return i;
+}
+
+function split_join_2(i) {
+    var x = (i + "-" + i).split("-");
+    x.push("" + i);
+    var res = x.join("->");
+    assertEq(res, i + "->" + i + "->" + i);
+    return i;
+}
+
+function resumeHere() { bailout(); }
+
+function split_join_3(i) {
+    var x = (i + "-" + i).split("-");
+    resumeHere();
+    var res = x.join("->");
+    assertEq(res, i + "->" + i);
+    return i;
+}
+
+function trip(i) {
+    if (i == 99)
+        assertEq(myjoin.arguments[1][0], "" + i)
+}
+
+function myjoin(i, x) {
+    trip(i);
+    return x.join("->");
+}
+
+function split_join_4(i) {
+    var x = (i + "-" + i).split("-");
+    var res = myjoin(i, x);
+    assertEq(res, i + "->" + i);
+    return i;
+}
+
 for (var i = 0; i < 100; ++i) {
     join_check(i);
     split(i);
     join(i);
+    split_join(i);
+    split_join_2(i);
+    split_join_3(i);
+    split_join_4(i);
 }

js/src/jit/MIR.cpp

@@ -3421,6 +3421,32 @@ MBoundsCheck::foldsTo(TempAllocator &alloc)
     return this;
 }
 
+MDefinition *
+MArrayJoin::foldsTo(TempAllocator &alloc) {
+    MDefinition *arr = array();
+
+    if (!arr->isStringSplit())
+        return this;
+
+    this->setRecoveredOnBailout();
+    if (arr->hasLiveDefUses()) {
+        this->setNotRecoveredOnBailout();
+        return this;
+    }
+
+    // We're replacing foo.split(bar).join(baz) by
+    // foo.replace(bar, baz).  MStringSplit could be recovered by
+    // a bailout.  As we are removing its last use, and its result
+    // could be captured by a resume point, this MStringSplit will
+    // be executed on the bailout path.
+    MDefinition *string = arr->toStringSplit()->string();
+    MDefinition *pattern = arr->toStringSplit()->separator();
+    MDefinition *replacement = sep();
+
+    setNotRecoveredOnBailout();
+    return MStringReplace::New(alloc, string, pattern, replacement);
+}
+
 bool
 jit::ElementAccessIsDenseNative(MDefinition *obj, MDefinition *id)
 {

js/src/jit/MIR.h

@@ -7196,6 +7196,7 @@ class MArrayJoin
     virtual AliasSet getAliasSet() const {
         return AliasSet::Load(AliasSet::Element | AliasSet::ObjectFields);
     }
+    MDefinition *foldsTo(TempAllocator &alloc);
 };
 
 class MLoadTypedArrayElement