Bug 1683614 - Post-barrier write to environment chain slot in Warp compiled suspend code r=iain

Differential Revision: https://phabricator.services.mozilla.com/D100798

js/src/jit-test/tests/warp/bug1683614.js

@@ -0,0 +1,14 @@
+// |jit-test| --ion-offthread-compile=off; --ion-full-warmup-threshold=0; --warp-async; --baseline-eager;
+//
+// The following testcase crashes on mozilla-central revision 20201219-3262affdccf6 (debug build, run with --fuzzing-safe --ion-offthread-compile=off --ion-full-warmup-threshold=0 --warp-async --baseline-eager):
+gczeal(9, 8);
+function s() { }
+new ReadableStream({
+    start() {
+        test();
+    }
+});
+async function test() {
+    for (let i17 = 1; i17 <= 30; i17++)
+        await s(0 + function () { return i17 });
+}

js/src/jit/WarpBuilder.cpp

@@ -2309,6 +2309,9 @@ bool WarpBuilder::buildSuspend(BytecodeLocation loc, MDefinition* gen,
       alloc(), genObj, AbstractGeneratorObject::envChainSlot(),
       current->environmentChain()));
 
+  current->add(
+      MPostWriteBarrier::New(alloc(), genObj, current->environmentChain()));
+
   // GeneratorReturn will return from the method, however to support MIR
   // generation isn't treated like the end of a block
   MGeneratorReturn* ret = MGeneratorReturn::New(alloc(), retVal);