Bug 932800 - Don't optimize string[x] GETELEM in Ion if x is not a number. r=h4writer

This commit is contained in:
Jan de Mooij 2013-11-01 16:10:14 +01:00
parent 984bfd7477
commit e8f23fc815

View File

@ -6565,7 +6565,12 @@ IonBuilder::getElemTryString(bool *emitted, MDefinition *obj, MDefinition *index
{
JS_ASSERT(*emitted == false);
if (obj->type() != MIRType_String)
if (obj->type() != MIRType_String || !IsNumberType(index->type()))
return true;
// If the index is expected to be out-of-bounds, don't optimize to avoid
// frequent bailouts.
if (bytecodeTypes(pc)->hasType(types::Type::UndefinedType()))
return true;
// Emit fast path for string[index].