Bug 757199 - Assertion failure: [barrier verifier] Unmarked edge: shape, r=bhackett

--HG--
extra : rebase_source : 3d62cae7c9523c0e03cd2fe0ea670c0f0646d6b3

js/src/jit-test/tests/basic/bug757199.js

@@ -0,0 +1,23 @@
+function ctor()
+{
+    this.a = 1;
+    this.b = 2;
+}
+function f2(o)
+{
+    o.c = 12;
+}
+function f()
+{
+    var x = new ctor();
+    verifybarriers();
+    f2(x);
+    verifybarriers();
+}
+f();
+f();
+var o = {};
+for (var i=0; i<1000; i++)
+    o['a'+i] = 3;
+f();
+f();

js/src/methodjit/PolyIC.cpp

@@ -560,6 +560,15 @@ class SetPropCompiler : public PICStubCompiler
             if (obj->numDynamicSlots() != slots)
                 return disable("insufficient slot capacity");
 
+#ifdef JSGC_INCREMENTAL_MJ
+            /*
+             * Since we're changing the object's shape, we need a write
+             * barrier. Taking the slow path is the easiest way to get one.
+             */
+            if (cx->compartment->needsBarrier())
+                return disable("ADDPROP write barrier required");
+#endif
+
             if (pic.typeMonitored && !updateMonitoredTypes())
                 return Lookup_Uncacheable;