Bug 988950 - Check whether value is an object after checking whether object is in nursery r=terrence
authorJon Coppeard <jcoppeard@mozilla.com>
Wed, 23 Apr 2014 13:48:34 +0100
changeset 179755 116fabfb50b5b219ea274a52ec6bdc2bb67c99f8
parent 179754 412bc4b9dd921e3fcf18127d00e43d4d5595557e
child 179756 b72e6cc2357400d932efd7cae75c4766984b06f8
push id26639
push userryanvm@gmail.com
push dateWed, 23 Apr 2014 20:42:51 +0000
treeherdermozilla-central@ed0236a51ed3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs988950
milestone31.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 988950 - Check whether value is an object after checking whether object is in nursery r=terrence
js/src/jit/CodeGenerator.cpp
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1856,31 +1856,31 @@ CodeGenerator::visitPostWriteBarrierO(LP
 bool
 CodeGenerator::visitPostWriteBarrierV(LPostWriteBarrierV *lir)
 {
 #ifdef JSGC_GENERATIONAL
     OutOfLineCallPostWriteBarrier *ool = new(alloc()) OutOfLineCallPostWriteBarrier(lir, lir->object());
     if (!addOutOfLineCode(ool))
         return false;
 
-    ValueOperand value = ToValue(lir, LPostWriteBarrierV::Input);
-    masm.branchTestObject(Assembler::NotEqual, value, ool->rejoin());
-
     const Nursery &nursery = GetIonContext()->runtime->gcNursery();
 
     if (lir->object()->isConstant()) {
         JS_ASSERT(!nursery.isInside(&lir->object()->toConstant()->toObject()));
     } else {
         Register temp = ToRegister(lir->temp());
         Register objreg = ToRegister(lir->object());
         masm.movePtr(ImmWord(-ptrdiff_t(nursery.start())), temp);
         masm.addPtr(objreg, temp);
         masm.branchPtr(Assembler::Below, temp, Imm32(Nursery::NurserySize), ool->rejoin());
     }
 
+    ValueOperand value = ToValue(lir, LPostWriteBarrierV::Input);
+    masm.branchTestObject(Assembler::NotEqual, value, ool->rejoin());
+
     // This section is a little different because we mustn't trash the temp
     // register before we use its contents.
     Register temp = ToRegister(lir->temp());
     masm.unboxObject(value, temp);
     masm.addPtr(ImmWord(-ptrdiff_t(nursery.start())), temp);
     masm.branchPtr(Assembler::Below, temp, Imm32(Nursery::NurserySize), ool->entry());
 
     masm.bind(ool->rejoin());