diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 49a7619c81b1..14dc55dbd2e3 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -7946,6 +7946,9 @@ IonBuilder::jsop_rest() MStoreElement *store = MStoreElement::New(alloc(), elements, index, arg, /* needsHoleCheck = */ false); current->add(store); + + if (NeedsPostBarrier(info(), arg)) + current->add(MPostWriteBarrier::New(alloc(), array, arg)); } // The array's length is incorrectly 0 now, from the template object