Bug 1046176 - Fix inlined UnsafeSetReservedSlot post barrier. r=nbp, a=sledru
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 30 Jul 2014 17:48:21 +0200
changeset 208207 247751fedbeb
parent 208206 3d310f9e5e5e
child 208208 2e2e1357e6ed
push id3768
push userryanvm@gmail.com
push date2014-07-31 14:32 +0000
treeherdermozilla-beta@247751fedbeb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp, sledru
bugs1046176
milestone32.0
Bug 1046176 - Fix inlined UnsafeSetReservedSlot post barrier. r=nbp, a=sledru
js/src/jit/MCallOptimize.cpp
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1796,17 +1796,17 @@ IonBuilder::inlineUnsafeSetReservedSlot(
 
     callInfo.setImplicitlyUsedUnchecked();
 
     MStoreFixedSlot *store = MStoreFixedSlot::New(alloc(), callInfo.getArg(0), slot, callInfo.getArg(2));
     current->add(store);
     current->push(store);
 
     if (NeedsPostBarrier(info(), callInfo.getArg(2)))
-        current->add(MPostWriteBarrier::New(alloc(), callInfo.thisArg(), callInfo.getArg(2)));
+        current->add(MPostWriteBarrier::New(alloc(), callInfo.getArg(0), callInfo.getArg(2)));
 
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
 IonBuilder::inlineUnsafeGetReservedSlot(CallInfo &callInfo)
 {
     if (callInfo.argc() != 2 || callInfo.constructing())