Bug 1296640: Get a reference into SIMD's memory at the end in BinaryScalar; r=jonco

MozReview-Commit-ID: JXBjIWtDXS5
***
fold

--HG--
extra : rebase_source : 47e69778a15f35ba5c3510a3de71b10b793fd6ca

js/src/builtin/SIMD.cpp

@@ -1039,17 +1039,18 @@ BinaryScalar(JSContext* cx, unsigned argc, Value* vp)
     if (args.length() != 2)
         return ErrorBadArgs(cx);
 
-    Elem result[V::lanes];
     if (!IsVectorObject<V>(args[0]))
         return ErrorBadArgs(cx);
 
-    Elem* val = TypedObjectMemory<Elem*>(args[0]);
     int32_t bits;
     if (!ToInt32(cx, args[1], &bits))
         return false;
 
+    Elem result[V::lanes];
+    Elem* val = TypedObjectMemory<Elem*>(args[0]);
     for (unsigned i = 0; i < V::lanes; i++)
         result[i] = Op<Elem>::apply(val[i], bits);
+
     return StoreResult<V>(cx, args, result);
 }
 

js/src/jit-test/tests/SIMD/bug1296640-gc-args.js

@@ -0,0 +1,9 @@
+if (typeof gczeal === 'undefined' || typeof SIMD === 'undefined') {
+    quit();
+}
+
+gczeal(9, 2);
+var Int8x16 = SIMD.Int8x16;
+var v = Int8x16();
+var good = { valueOf: () => 21 };
+Int8x16.shiftLeftByScalar(v, good);