Bug 629968 - Patch SunSpider performance regression. r=brendan, a=sayrer.

This is a temporary hack.

There are two closely related bugs in methodWriteBarrier. One: the two
signatures are meant to be essentially the same, but they aren't; the
slot-based signature fails to do thrash detection in a common case.
Two: if thrash detection were always done, it would unbrand the global
object, wrecking our SunSpider score. Both bugs are tracked in bug
630354.

The bugs have been precariously balanced against one another for a
while. I accidentally changed the status quo in rev b90090c29571,
causing a 15% SS regression. This patch changes it back.

--HG--
extra : rebase_source : d2e4605599b633b968277b7f5c1a4fba7218d7d7

js/src/jsobj.cpp

@@ -5274,7 +5274,9 @@ js_NativeSet(JSContext *cx, JSObject *obj, const Shape *shape, bool added, Value
         if (shape->hasDefaultSetter()) {
             if (!added) {
                 AbortRecordingIfUnexpectedGlobalWrite(cx, obj, slot);
-                if (!obj->methodWriteBarrier(cx, *shape, *vp))
+
+                /* FIXME: This should pass *shape, not slot, but see bug 630354. */
+                if (!obj->methodWriteBarrier(cx, slot, *vp))
                     return false;
             }
             obj->nativeSetSlot(slot, *vp);