diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp index 8169b86be58c..f9d47fdd84cb 100644 --- a/js/src/methodjit/Compiler.cpp +++ b/js/src/methodjit/Compiler.cpp @@ -5352,12 +5352,12 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed) types->addFreeze(cx); uint32_t slot = propertyTypes->definiteSlot(); RegisterID reg = frame.tempRegForData(lhs); + frame.pinReg(reg); bool isObject = lhs->isTypeKnown(); MaybeJump notObject; if (!isObject) notObject = frame.testObject(Assembler::NotEqual, lhs); #ifdef JSGC_INCREMENTAL_MJ - frame.pinReg(reg); if (cx->compartment->needsBarrier() && propertyTypes->needsBarrier(cx)) { /* Write barrier. */ Jump j = masm.testGCThing(Address(reg, JSObject::getFixedSlotOffset(slot))); @@ -5368,7 +5368,6 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed) OOL_STUBCALL(stubs::GCThingWriteBarrier, REJOIN_NONE); stubcc.rejoin(Changes(0)); } - frame.unpinReg(reg); #endif if (!isObject) { stubcc.linkExit(notObject.get(), Uses(2)); @@ -5377,6 +5376,7 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed) OOL_STUBCALL(STRICT_VARIANT(stubs::SetName), REJOIN_FALLTHROUGH); } frame.storeTo(rhs, Address(reg, JSObject::getFixedSlotOffset(slot)), popGuaranteed); + frame.unpinReg(reg); frame.shimmy(1); if (!isObject) stubcc.rejoin(Changes(1));