Bug 1188290 - Remove an incomplete assertion about store buffer state; r=jandem

js/src/gc/StoreBuffer.h

@@ -447,14 +447,6 @@ class StoreBuffer
         putFromAnyThread(bufferGeneric, CallbackRef<Key>(callback, key, data));
     }
 
-    void assertHasCellEdge(Cell** cellp) {
-        CellPtrEdge cpe(cellp);
-
-        MOZ_ASSERT(bufferCell.has(this, CellPtrEdge(cellp)) ||
-                   !CellPtrEdge(cellp).maybeInRememberedSet(nursery_));
-
-    }
-
     void assertHasValueEdge(JS::Value* vp) {
         MOZ_ASSERT(bufferVal.has(this, ValueEdge(vp)) ||
                    !ValueEdge(vp).maybeInRememberedSet(nursery_));

js/src/jit-test/tests/gc/bug-1188290.js

@@ -0,0 +1,12 @@
+this.__proto__ = [];
+var T = TypedObject;
+var ObjectStruct = new T.StructType({f: T.Object});
+var o = new ObjectStruct();
+minorgc();
+function writeObject(o, v) {
+    o.f = v;
+    assertEq(typeof o.f, "object");
+}
+for (var i = 0; i < 5; i++)
+    writeObject(o, { toString: function() { return "helo"} }
+);

js/src/jsobj.h

@@ -642,11 +642,11 @@ JSObject::writeBarrierPost(void* cellp, JSObject* prev, JSObject* next)
     js::gc::StoreBuffer* buffer;
     if (next && (buffer = next->storeBuffer())) {
         // If we know that the prev has already inserted an entry, we can skip
-        // doing the lookup to add the new entry.
+        // doing the lookup to add the new entry. Note that we cannot safely
-        if (prev && prev->storeBuffer()) {
+        // assert the presence of the entry because it may have been added
-            buffer->assertHasCellEdge(static_cast<js::gc::Cell**>(cellp));
+        // via a different store buffer.
+        if (prev && prev->storeBuffer())
             return;
-        }
         buffer->putCellFromAnyThread(static_cast<js::gc::Cell**>(cellp));
         return;
     }