From 642bdf90083ae6ee6fc9f0ab02869e49c89a749c Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 5 Jan 2017 10:22:16 +0100
Subject: [PATCH] Bug 1328148: IonMonkey - Use MConcat for more cases, r=jandem

---
 js/public/TrackedOptimizationInfo.h     |  1 +
 js/src/doc/JITOptimizations/Outcomes.md |  4 ++++
 js/src/jit/IonBuilder.cpp               | 15 +++++++++------
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/js/public/TrackedOptimizationInfo.h b/js/public/TrackedOptimizationInfo.h
index b697765c9ce9..3e110aed77ce 100644
--- a/js/public/TrackedOptimizationInfo.h
+++ b/js/public/TrackedOptimizationInfo.h
@@ -107,6 +107,7 @@ namespace JS {
     _(OperandNotNumber)                                                 \
     _(OperandNotStringOrNumber)                                         \
     _(OperandNotSimpleArith)                                            \
+    _(OperandNotEasilyCoercibleToString)                                \
     _(StaticTypedArrayUint32)                                           \
     _(StaticTypedArrayCantComputeMask)                                  \
     _(OutOfBounds)                                                      \
diff --git a/js/src/doc/JITOptimizations/Outcomes.md b/js/src/doc/JITOptimizations/Outcomes.md
index b0eb9c43af62..abfb09791151 100644
--- a/js/src/doc/JITOptimizations/Outcomes.md
+++ b/js/src/doc/JITOptimizations/Outcomes.md
@@ -188,6 +188,10 @@ Optimization failed because of failing to speculate the operand is a string or a
 
 Optimization failed because of failing to speculate the operand is a simple arithmetic type. I.e. definitely not an object, string, symbol or internal magic type.
 
+### OperandNotEasilyCoercibleToString
+
+Optimization failed because of failing to speculate the operand can be easily coerced to a string. I.e. definitely not an object or symbol.
+
 ### StaticTypedArrayUint32
 
 Typed Arrays of uint32 values are not yet fully optimized.
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 4e40e882703c..9b1b1367d235 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3180,14 +3180,17 @@ IonBuilder::binaryArithTryConcat(bool* emitted, JSOp op, MDefinition* left, MDef
         return Ok();
     }
 
-    // The none-string input (if present) should be atleast a numerical type.
-    // Which we can easily coerce to string.
-    if (right->type() != MIRType::String && !IsNumberType(right->type())) {
-        trackOptimizationOutcome(TrackedOutcome::OperandNotStringOrNumber);
+    // The non-string input (if present) should be atleast easily coercible to string.
+    if (right->type() != MIRType::String &&
+        (right->mightBeType(MIRType::Symbol) || right->mightBeType(MIRType::Object)))
+    {
+        trackOptimizationOutcome(TrackedOutcome::OperandNotEasilyCoercibleToString);
         return Ok();
     }
-    if (left->type() != MIRType::String && !IsNumberType(left->type())) {
-        trackOptimizationOutcome(TrackedOutcome::OperandNotStringOrNumber);
+    if (left->type() != MIRType::String &&
+        (left->mightBeType(MIRType::Symbol) || left->mightBeType(MIRType::Object)))
+    {
+        trackOptimizationOutcome(TrackedOutcome::OperandNotEasilyCoercibleToString);
         return Ok();
     }