Bug 1178976: Add a post-write barrier to ObjectWeakMap::add. r=terrence

--HG--
extra : rebase_source : 9837fe45a1c8735a816df800d965d10494ab7a0d

js/src/jsweakmap.cpp

@@ -345,8 +345,6 @@ TryPreserveReflector(JSContext* cx, HandleObject obj)
 static inline void
 WeakMapPostWriteBarrier(JSRuntime* rt, ObjectValueMap* weakMap, JSObject* key)
 {
-    // Strip the barriers from the type before inserting into the store buffer.
-    // This will automatically ensure that barriers do not fire during GC.
     if (key && IsInsideNursery(key))
         rt->gc.storeBuffer.putGeneric(gc::HashKeyRef<ObjectValueMap, JSObject*>(weakMap, key));
 }
@@ -708,6 +706,8 @@ ObjectWeakMap::add(JSContext* cx, JSObject* obj, JSObject* target)
         ReportOutOfMemory(cx);
         return false;
     }
+    if (IsInsideNursery(obj))
+        cx->runtime()->gc.storeBuffer.putGeneric(StoreBufferRef(&map, obj));
 
     return true;
 }

js/src/vm/WeakMapObject.h

@@ -34,6 +34,7 @@ class ObjectWeakMap
 {
   private:
     ObjectValueMap map;
+    typedef gc::HashKeyRef<ObjectValueMap, JSObject*> StoreBufferRef;
 
   public:
     explicit ObjectWeakMap(JSContext* cx);