From 02aa0faaee9310c817376e63489b3128e56af7b2 Mon Sep 17 00:00:00 2001
From: Iain Ireland <iireland@mozilla.com>
Date: Tue, 24 Jan 2023 16:48:15 +0000
Subject: [PATCH] Bug 1801985: Generate postbarrier in ObjectToIterator
 r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D167340
---
 js/src/jit/CodeGenerator.cpp         | 21 +++++++++++++++++++--
 js/src/jit/WarpCacheIRTranspiler.cpp |  3 ---
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 20421604a0e4..bd4da912cc3f 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -14063,13 +14063,30 @@ void CodeGenerator::visitObjectToIterator(LObjectToIterator* lir) {
   masm.storePtr(
       obj, Address(nativeIter, NativeIterator::offsetOfObjectBeingIterated()));
   masm.or32(Imm32(NativeIterator::Flags::Active), iterFlagsAddr);
-  // The postbarrier for |objectBeingIterated| is generated separately by the
-  // transpiler.
 
   Register enumeratorsAddr = temp2;
   masm.movePtr(ImmPtr(lir->mir()->enumeratorsAddr()), enumeratorsAddr);
   masm.registerIterator(enumeratorsAddr, nativeIter, temp3);
 
+  // Generate post-write barrier for storing to |iterObj->objectBeingIterated_|.
+  // We already know that |iterObj| is tenured, so we only have to check |obj|.
+  Label skipBarrier;
+  masm.branchPtrInNurseryChunk(Assembler::NotEqual, obj, temp2, &skipBarrier);
+  {
+    LiveRegisterSet save = liveVolatileRegs(lir);
+    save.takeUnchecked(temp);
+    save.takeUnchecked(temp2);
+    save.takeUnchecked(temp3);
+    if (iterObj.volatile_()) {
+      save.addUnchecked(iterObj);
+    }
+
+    masm.PushRegsInMask(save);
+    emitPostWriteBarrier(iterObj);
+    masm.PopRegsInMask(save);
+  }
+  masm.bind(&skipBarrier);
+
   masm.bind(ool->rejoin());
 }
 
diff --git a/js/src/jit/WarpCacheIRTranspiler.cpp b/js/src/jit/WarpCacheIRTranspiler.cpp
index e0f066901f3b..8a4b9b43ec6a 100644
--- a/js/src/jit/WarpCacheIRTranspiler.cpp
+++ b/js/src/jit/WarpCacheIRTranspiler.cpp
@@ -743,9 +743,6 @@ bool WarpCacheIRTranspiler::emitObjectToIteratorResult(
     return false;
   }
 
-  auto* barrier = MPostWriteBarrier::New(alloc(), ins, obj);
-  add(barrier);
-
   return true;
 }