Bug 713226 - Fix SETPROP write barrier in methodjit (r=bhackett)

js/src/jit-test/tests/basic/bug713226.js

@@ -0,0 +1,21 @@
+// |jit-test| mjitalways;
+gczeal(4);
+var optionNames = options().split(',');
+  for (var i = 0; i < optionNames.length; i++)
+    var optionName = optionNames[i];
+      options(optionName);
+evaluate("\
+function addDebug(g, id) {\
+    var debuggerGlobal = newGlobal('new-compartment');\
+    debuggerGlobal.debuggee = g;\
+    debuggerGlobal.id = id;\
+    debuggerGlobal.print = function (s) { (g) += s; };\
+    debuggerGlobal.eval('var dbg = new Debugger(debuggee);dbg.onDebuggerStatement = function () { print(id); debugger; };');\
+    return debuggerGlobal;\
+}\
+var base = newGlobal('new-compartment');\
+var top = base;\
+for (var i = 0; i < 8; i++ )\
+    top = addDebug(top, i);\
+base.eval('debugger;');\
+");

js/src/methodjit/Compiler.cpp

@@ -5627,16 +5627,18 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed)
     if (script->pcCounters)
         bumpPropCounter(PC, OpcodeCounts::PROP_OTHER);
 
+    JSOp op = JSOp(*PC);
+
 #ifdef JSGC_INCREMENTAL_MJ
-    /* Write barrier. */
+    /* Write barrier. We only have type information for JSOP_SETPROP. */
-    if (cx->compartment->needsBarrier() && (!types || types->propertyNeedsBarrier(cx, id))) {
+    if (cx->compartment->needsBarrier() &&
+        (!types || op != JSOP_SETPROP || types->propertyNeedsBarrier(cx, id)))
+    {
         jsop_setprop_slow(name);
         return true;
     }
 #endif
 
-    JSOp op = JSOp(*PC);
-
     ic::PICInfo::Kind kind = (op == JSOP_SETMETHOD)
                              ? ic::PICInfo::SETMETHOD
                              : ic::PICInfo::SET;