Cherry-picks a WebKit change to revert recent changes to String addition for JSC.

WebKit change http://trac.webkit.org/changeset/51975 modified String addition in
JSC to use ropes. However, the change was incorrect, so was rolled back in
http://trac.webkit.org/changeset/51978.

The last WebKit merge was to revision r51976, so picked up the initial, broken
change only.

This change cherry-picks http://trac.webkit.org/changeset/51978 to revert the
original change.

Bug: 2336856
Change-Id: I7f48bce6a7f605779424ba0a7601524ab3a71990

1 files changed, 22 insertions, 47 deletions

diff --git a/JavaScriptCore/runtime/Operations.h b/JavaScriptCore/runtime/Operations.h
index 0289ac2..1cab06d 100644
--- a/JavaScriptCore/runtime/Operations.h
+++ b/JavaScriptCore/runtime/Operations.h
@@ -37,11 +37,6 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
     {
-        if (!s1->length())
-            return s2;
-        if (!s2->length())
-            return s1;
-
         unsigned ropeLength = s1->ropeLength() + s2->ropeLength();
         JSGlobalData* globalData = &exec->globalData();
 
@@ -58,42 +53,6 @@ namespace JSC {
         return new (globalData) JSString(globalData, rope.release());
     }
 
-    ALWAYS_INLINE JSValue jsString(ExecState* exec, const UString& u1, JSString* s2)
-    {
-        unsigned ropeLength = 1 + s2->ropeLength();
-        JSGlobalData* globalData = &exec->globalData();
-
-        if (ropeLength <= JSString::s_maxInternalRopeLength)
-            return new (globalData) JSString(globalData, ropeLength, u1, s2);
-
-        unsigned index = 0;
-        RefPtr<JSString::Rope> rope = JSString::Rope::createOrNull(ropeLength);
-        if (UNLIKELY(!rope))
-            return throwOutOfMemoryError(exec);
-        rope->append(index, u1);
-        rope->append(index, s2);
-        ASSERT(index == ropeLength);
-        return new (globalData) JSString(globalData, rope.release());
-    }
-
-    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, const UString& u2)
-    {
-        unsigned ropeLength = s1->ropeLength() + 1;
-        JSGlobalData* globalData = &exec->globalData();
-
-        if (ropeLength <= JSString::s_maxInternalRopeLength)
-            return new (globalData) JSString(globalData, ropeLength, s1, u2);
-
-        unsigned index = 0;
-        RefPtr<JSString::Rope> rope = JSString::Rope::createOrNull(ropeLength);
-        if (UNLIKELY(!rope))
-            return throwOutOfMemoryError(exec);
-        rope->append(index, s1);
-        rope->append(index, u2);
-        ASSERT(index == ropeLength);
-        return new (globalData) JSString(globalData, rope.release());
-    }
-
     ALWAYS_INLINE JSValue jsString(ExecState* exec, Register* strings, unsigned count)
     {
         ASSERT(count >= 3);
@@ -288,14 +247,30 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        double left = 0.0, right;
-        if (v1.getNumber(left), v2.getNumber(right))
+        double left;
+        double right = 0.0;
+
+        bool rightIsNumber = v2.getNumber(right);
+        if (rightIsNumber && v1.getNumber(left))
             return jsNumber(callFrame, left + right);
         
-        if (v1.isString()) {
-            return v2.isString()
-                ? jsString(callFrame, asString(v1), asString(v2))
-                : jsString(callFrame, asString(v1), v2.toString(callFrame));
+        bool leftIsString = v1.isString();
+        if (leftIsString && v2.isString()) {
+            if (!asString(v1)->length())
+                return asString(v2);
+            if (!asString(v2)->length())
+                return asString(v1);
+            return jsString(callFrame, asString(v1), asString(v2));
+        }
+
+        if (rightIsNumber & leftIsString) {
+            RefPtr<UString::Rep> value = v2.isInt32() ?
+                concatenate(asString(v1)->value(callFrame).rep(), v2.asInt32()) :
+                concatenate(asString(v1)->value(callFrame).rep(), right);
+
+            if (!value)
+                return throwOutOfMemoryError(callFrame);
+            return jsString(callFrame, value.release());
         }
 
         // All other cases are pretty uncommon