Bug 1004457 - Remove unused mutable value operations from BarrieredBase; r=jonco

js/src/gc/Barrier.h

@@ -407,11 +407,14 @@ struct InternalGCMethods<jsid>
     static void postBarrierRemove(jsid *idp) {}
 };
 
+template <typename T>
+class BarrieredBaseMixins {};
+
 /*
  * Base class for barriered pointer types.
  */
 template <class T>
-class BarrieredBase : public HeapBase<T>
+class BarrieredBase : public BarrieredBaseMixins<T>
 {
   protected:
     T value;
@@ -436,6 +439,7 @@ class BarrieredBase : public HeapBase<T>
      * Obviously this is dangerous unless you know the barrier is not needed.
      */
     T *unsafeGet() { return &value; }
+    const T *unsafeGet() const { return &value; }
     void unsafeSet(T v) { value = v; }
 
     T operator->() const { return value; }
@@ -451,6 +455,15 @@ class BarrieredBase : public HeapBase<T>
     void pre(Zone *zone) { InternalGCMethods<T>::preBarrier(zone, value); }
 };
 
+template <>
+class BarrieredBaseMixins<JS::Value> : public ValueOperations<BarrieredBase<JS::Value> >
+{
+    friend class ValueOperations<BarrieredBase<JS::Value> >;
+    const JS::Value * extract() const {
+        return static_cast<const BarrieredBase<JS::Value>*>(this)->unsafeGet();
+    }
+};
+
 /*
  * PreBarriered only automatically handles pre-barriers. Post-barriers must
  * be manually implemented when using this class. HeapPtr and RelocatablePtr

js/src/jit-test/tests/gc/bug-1004457.js

@@ -0,0 +1,3 @@
+var argObj = (function () { return arguments })();
+gczeal(4);
+delete argObj.callee;

js/src/vm/ArgumentsObject.h

@@ -295,7 +295,7 @@ class NormalArgumentsObject : public ArgumentsObject
 
     /* Clear the location storing arguments.callee's initial value. */
     void clearCallee() {
-        data()->callee.setMagic(JS_OVERWRITTEN_CALLEE);
+        data()->callee = MagicValue(JS_OVERWRITTEN_CALLEE);
     }
 };