diff --git a/js/src/ion/CodeGenerator.cpp b/js/src/ion/CodeGenerator.cpp index 4119291e2a1..df4553dc1d6 100644 --- a/js/src/ion/CodeGenerator.cpp +++ b/js/src/ion/CodeGenerator.cpp @@ -6242,9 +6242,8 @@ CodeGenerator::visitGetDOMProperty(LGetDOMProperty *ins) masm.checkStackAlignment(); - // Make space for the outparam. Pre-initialize it to UndefinedValue so we - // can trace it at GC time. - masm.pushValue(UndefinedValue()); + /* Make Space for the outparam */ + masm.adjustStack(-int32_t(sizeof(Value))); masm.movePtr(StackPointer, ValueReg); masm.Push(ObjectReg); @@ -6308,7 +6307,7 @@ CodeGenerator::visitSetDOMProperty(LSetDOMProperty *ins) masm.checkStackAlignment(); - // Push the argument. Rooting will happen at GC time. + // Push thei argument. Rooting will happen at GC time. ValueOperand argVal = ToValue(ins, LSetDOMProperty::Value); masm.Push(argVal); masm.movePtr(StackPointer, ValueReg); diff --git a/js/src/ion/IonFrames.cpp b/js/src/ion/IonFrames.cpp index 4c9ea8c1090..fb1de17afa6 100644 --- a/js/src/ion/IonFrames.cpp +++ b/js/src/ion/IonFrames.cpp @@ -832,14 +832,14 @@ MarkIonExitFrame(JSTracer *trc, const IonFrameIterator &frame) if (frame.isDOMExit()) { IonDOMExitFrameLayout *dom = frame.exitFrame()->DOMExit(); gc::MarkObjectRoot(trc, dom->thisObjAddress(), "ion-dom-args"); - if (dom->isMethodFrame()) { + if (dom->isSetterFrame()) { + gc::MarkValueRoot(trc, dom->vp(), "ion-dom-args"); + } else if (dom->isMethodFrame()) { IonDOMMethodExitFrameLayout *method = reinterpret_cast(dom); size_t len = method->argc() + 2; Value *vp = method->vp(); gc::MarkValueRootRange(trc, len, vp, "ion-dom-args"); - } else { - gc::MarkValueRoot(trc, dom->vp(), "ion-dom-args"); } return; } diff --git a/js/src/ion/arm/IonFrames-arm.h b/js/src/ion/arm/IonFrames-arm.h index 085b25a38ae..c9d5268c6af 100644 --- a/js/src/ion/arm/IonFrames-arm.h +++ b/js/src/ion/arm/IonFrames-arm.h @@ -397,6 +397,9 @@ class IonDOMExitFrameLayout inline JSObject **thisObjAddress() { return &thisObj; } + inline bool isSetterFrame() { + return footer_.ionCode() == ION_FRAME_DOMSETTER; + } inline bool isMethodFrame() { return footer_.ionCode() == ION_FRAME_DOMMETHOD; } diff --git a/js/src/ion/shared/IonFrames-x86-shared.h b/js/src/ion/shared/IonFrames-x86-shared.h index 7d13427378c..9100f3b3841 100644 --- a/js/src/ion/shared/IonFrames-x86-shared.h +++ b/js/src/ion/shared/IonFrames-x86-shared.h @@ -362,6 +362,9 @@ class IonDOMExitFrameLayout inline JSObject **thisObjAddress() { return &thisObj; } + inline bool isSetterFrame() { + return footer_.ionCode() == ION_FRAME_DOMSETTER; + } inline bool isMethodFrame() { return footer_.ionCode() == ION_FRAME_DOMMETHOD; }