725605 - IonMonkey: CallGetProperty should accept both objects and strings

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

date-format-xparb has this function:
--
var result = new String(val);
// ...
while (result.length < size) {
    result = ch + result;
}
--
result.length bails out because result is a string after the first iteration and is unboxed as object. The patch changes CallGetProperty to accept a Value so that we can handle both objects and strings without bailing out.

The patch may regress some other tests a bit, but I think this is the right way forward and we can use IC's or fast paths to fix these regressions.

Comment 1

[Jan de Mooij [:jandem]]

http://hg.mozilla.org/projects/ionmonkey/rev/5c6072296e4a