Bug 961875 - Add missing post barrier in IonBuilder::jsop_rest; r=shu
authorTerrence Cole <terrence@mozilla.com>
Thu, 20 Feb 2014 13:16:20 -0800
changeset 170117 a20e77e55c4f8ec2d93c0145641fc7b52ad51121
parent 170116 a444cf2a9b09be4c504935292a9284b9e9c2fbe0
child 170118 1acdcb6714972eb6a2556f1f055182251c2795dd
push id270
push userpvanderbeken@mozilla.com
push dateThu, 06 Mar 2014 09:24:21 +0000
reviewersshu
bugs961875
milestone30.0a1
Bug 961875 - Add missing post barrier in IonBuilder::jsop_rest; r=shu
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -7941,16 +7941,19 @@ IonBuilder::jsop_rest()
     for (unsigned i = numFormals; i < numActuals; i++) {
         index = MConstant::New(alloc(), Int32Value(i - numFormals));
         current->add(index);
 
         MDefinition *arg = inlineCallInfo_->argv()[i];
         MStoreElement *store = MStoreElement::New(alloc(), elements, index, arg,
                                                   /* needsHoleCheck = */ false);
         current->add(store);
+
+        if (NeedsPostBarrier(info(), arg))
+            current->add(MPostWriteBarrier::New(alloc(), array, arg));
     }
 
     // The array's length is incorrectly 0 now, from the template object
     // created by BaselineCompiler::emit_JSOP_REST() before the actual argument
     // count was known. Set the correct length now that we know that count.
     MSetArrayLength *length = MSetArrayLength::New(alloc(), elements, index);
     current->add(length);