Bug 1303780: Get a reference into SIMD's memory at the end in ReplaceLane; r=jonco

MozReview-Commit-ID: LiLgZ48Cz3a

--HG--
extra : rebase_source : 730907dbf006a031ffc69290da90fbc22c901187
extra : amend_source : 9721e8507930092e8040768330d8e24477f37485

js/src/builtin/SIMD.cpp

@@ -960,9 +960,6 @@ ReplaceLane(JSContext* cx, unsigned argc, Value* vp)
     if (args.length() < 2 || !IsVectorObject<V>(args[0]))
         return ErrorBadArgs(cx);
 
-    Elem* vec = TypedObjectMemory<Elem*>(args[0]);
-    Elem result[V::lanes];
-
     unsigned lane;
     if (!ArgumentToLaneIndex(cx, args[1], V::lanes, &lane))
         return false;
@@ -971,8 +968,11 @@ ReplaceLane(JSContext* cx, unsigned argc, Value* vp)
     if (!V::Cast(cx, args.get(2), &value))
         return false;
 
+    Elem* vec = TypedObjectMemory<Elem*>(args[0]);
+    Elem result[V::lanes];
     for (unsigned i = 0; i < V::lanes; i++)
         result[i] = i == lane ? value : vec[i];
+
     return StoreResult<V>(cx, args, result);
 }
 

js/src/jit-test/tests/SIMD/bug1303780-gc-args.js

@@ -0,0 +1,12 @@
+if (typeof gczeal === 'undefined' || typeof SIMD === 'undefined') {
+    quit();
+}
+
+gczeal(14,2);
+var Float32x4 = SIMD.Float32x4;
+function test() {
+    var v = Float32x4(1,2,3,4);
+    var good = {valueOf: () => 42};
+    Float32x4.replaceLane(v, 0, good);
+}
+test();