From 83c903514d5fabf66842b934b20918c06badc73d Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Fri, 17 May 2013 23:03:38 -0400
Subject: [PATCH] Back out revision 2a1149f381ed (bug 873209) because
 apparently pushValue does not adjust the frame size and hence we got a CLOSED
 TREE

---
 js/src/ion/CodeGenerator.cpp             | 7 +++----
 js/src/ion/IonFrames.cpp                 | 6 +++---
 js/src/ion/arm/IonFrames-arm.h           | 3 +++
 js/src/ion/shared/IonFrames-x86-shared.h | 3 +++
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/js/src/ion/CodeGenerator.cpp b/js/src/ion/CodeGenerator.cpp
index 4119291e2a1..df4553dc1d6 100644
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -6242,9 +6242,8 @@ CodeGenerator::visitGetDOMProperty(LGetDOMProperty *ins)
 
     masm.checkStackAlignment();
 
-    // Make space for the outparam.  Pre-initialize it to UndefinedValue so we
-    // can trace it at GC time.
-    masm.pushValue(UndefinedValue());
+    /* Make Space for the outparam */
+    masm.adjustStack(-int32_t(sizeof(Value)));
     masm.movePtr(StackPointer, ValueReg);
 
     masm.Push(ObjectReg);
@@ -6308,7 +6307,7 @@ CodeGenerator::visitSetDOMProperty(LSetDOMProperty *ins)
 
     masm.checkStackAlignment();
 
-    // Push the argument. Rooting will happen at GC time.
+    // Push thei argument. Rooting will happen at GC time.
     ValueOperand argVal = ToValue(ins, LSetDOMProperty::Value);
     masm.Push(argVal);
     masm.movePtr(StackPointer, ValueReg);
diff --git a/js/src/ion/IonFrames.cpp b/js/src/ion/IonFrames.cpp
index 4c9ea8c1090..fb1de17afa6 100644
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -832,14 +832,14 @@ MarkIonExitFrame(JSTracer *trc, const IonFrameIterator &frame)
     if (frame.isDOMExit()) {
         IonDOMExitFrameLayout *dom = frame.exitFrame()->DOMExit();
         gc::MarkObjectRoot(trc, dom->thisObjAddress(), "ion-dom-args");
-        if (dom->isMethodFrame()) {
+        if (dom->isSetterFrame()) {
+            gc::MarkValueRoot(trc, dom->vp(), "ion-dom-args");
+        } else if (dom->isMethodFrame()) {
             IonDOMMethodExitFrameLayout *method =
                 reinterpret_cast<IonDOMMethodExitFrameLayout *>(dom);
             size_t len = method->argc() + 2;
             Value *vp = method->vp();
             gc::MarkValueRootRange(trc, len, vp, "ion-dom-args");
-        } else {
-            gc::MarkValueRoot(trc, dom->vp(), "ion-dom-args");
         }
         return;
     }
diff --git a/js/src/ion/arm/IonFrames-arm.h b/js/src/ion/arm/IonFrames-arm.h
index 085b25a38ae..c9d5268c6af 100644
--- a/js/src/ion/arm/IonFrames-arm.h
+++ b/js/src/ion/arm/IonFrames-arm.h
@@ -397,6 +397,9 @@ class IonDOMExitFrameLayout
     inline JSObject **thisObjAddress() {
         return &thisObj;
     }
+    inline bool isSetterFrame() {
+        return footer_.ionCode() == ION_FRAME_DOMSETTER;
+    }
     inline bool isMethodFrame() {
         return footer_.ionCode() == ION_FRAME_DOMMETHOD;
     }
diff --git a/js/src/ion/shared/IonFrames-x86-shared.h b/js/src/ion/shared/IonFrames-x86-shared.h
index 7d13427378c..9100f3b3841 100644
--- a/js/src/ion/shared/IonFrames-x86-shared.h
+++ b/js/src/ion/shared/IonFrames-x86-shared.h
@@ -362,6 +362,9 @@ class IonDOMExitFrameLayout
     inline JSObject **thisObjAddress() {
         return &thisObj;
     }
+    inline bool isSetterFrame() {
+        return footer_.ionCode() == ION_FRAME_DOMSETTER;
+    }
     inline bool isMethodFrame() {
         return footer_.ionCode() == ION_FRAME_DOMMETHOD;
     }