Bug 1046176 - Fix inlined UnsafeSetReservedSlot post barrier. r=nbp, a=sledru
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 30 Jul 2014 17:48:21 +0200
changeset 209291 247751fedbeb05368a222a75ab2c4afda2d5101c
parent 209290 3d310f9e5e5e8ad2ab35ee44a34c5abd45c25b7e
child 209292 2e2e1357e6ede728d20f273a418700d41d2c0f4c
push id494
push userraliiev@mozilla.com
push dateMon, 25 Aug 2014 18:42:16 +0000
treeherdermozilla-release@a3cc3e46b571 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp, sledru
bugs1046176
milestone32.0
Bug 1046176 - Fix inlined UnsafeSetReservedSlot post barrier. r=nbp, a=sledru
js/src/jit/MCallOptimize.cpp
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1796,17 +1796,17 @@ IonBuilder::inlineUnsafeSetReservedSlot(
 
     callInfo.setImplicitlyUsedUnchecked();
 
     MStoreFixedSlot *store = MStoreFixedSlot::New(alloc(), callInfo.getArg(0), slot, callInfo.getArg(2));
     current->add(store);
     current->push(store);
 
     if (NeedsPostBarrier(info(), callInfo.getArg(2)))
-        current->add(MPostWriteBarrier::New(alloc(), callInfo.thisArg(), callInfo.getArg(2)));
+        current->add(MPostWriteBarrier::New(alloc(), callInfo.getArg(0), callInfo.getArg(2)));
 
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
 IonBuilder::inlineUnsafeGetReservedSlot(CallInfo &callInfo)
 {
     if (callInfo.argc() != 2 || callInfo.constructing())