Bug 988950 - Check whether value is an object after checking whether object is in nursery r=terrence

js/src/jit/CodeGenerator.cpp

@@ -1861,9 +1861,6 @@ CodeGenerator::visitPostWriteBarrierV(LPostWriteBarrierV *lir)
     if (!addOutOfLineCode(ool))
         return false;
 
-    ValueOperand value = ToValue(lir, LPostWriteBarrierV::Input);
-    masm.branchTestObject(Assembler::NotEqual, value, ool->rejoin());
-
     const Nursery &nursery = GetIonContext()->runtime->gcNursery();
 
     if (lir->object()->isConstant()) {
@@ -1876,6 +1873,9 @@ CodeGenerator::visitPostWriteBarrierV(LPostWriteBarrierV *lir)
         masm.branchPtr(Assembler::Below, temp, Imm32(Nursery::NurserySize), ool->rejoin());
     }
 
+    ValueOperand value = ToValue(lir, LPostWriteBarrierV::Input);
+    masm.branchTestObject(Assembler::NotEqual, value, ool->rejoin());
+
     // This section is a little different because we mustn't trash the temp
     // register before we use its contents.
     Register temp = ToRegister(lir->temp());