Bug 1661410 - Post-barrier writes to TypedObject string references r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D88466

js/src/jit-test/tests/TypedObject/bug1661410-stringpost.js

@@ -0,0 +1,12 @@
+gczeal(2, 2000);
+
+var tobj = TypedObject;
+var StringStruct = new tobj.StructType({
+    str: tobj.string
+});
+var s = new StringStruct();
+function writeString(to, v91) {
+  to.str += v91;
+}
+for (var i = 0; i < 9500; i++)
+  writeString(s, 'x');

js/src/jit/IonCacheIRCompiler.cpp

@@ -1610,7 +1610,7 @@ bool IonCacheIRCompiler::emitStoreTypedObjectReferenceProperty(
 
   emitStoreTypedObjectReferenceProp(val, type, dest, scratch2);
 
-  if (needsPostBarrier() && type != ReferenceType::TYPE_STRING) {
+  if (needsPostBarrier()) {
     emitPostBarrierSlot(obj, val, scratch1);
   }
   return true;