Bug 945275 - Mark ThisV in rectifier frames r=jandem

js/src/jit-test/tests/gc/bug-945275.js

@@ -0,0 +1,11 @@
+function TestCase(n) {
+  this.name = undefined;
+  this.description = undefined;
+}
+gczeal(7,1);
+eval("\
+function reportCompare() new TestCase;\
+reportCompare();\
+Object.defineProperty(Object.prototype, 'name', {});\
+reportCompare();\
+");

js/src/jit-test/tests/gc/bug-957114.js

@@ -0,0 +1,13 @@
+gczeal(7,1);
+function TestCase(n) {
+  this.name = '';
+  this.description = '';
+  this.expect = '';
+  this.actual = '';
+  this.reason = '';
+  this.passed = '';
+}
+function test() new TestCase;
+test();
+Object.defineProperty(Object.prototype, "name", {});
+test();

js/src/jit/IonFrames.cpp

@@ -1102,6 +1102,15 @@ MarkJitExitFrame(JSTracer *trc, const IonFrameIterator &frame)
     }
 }
 
+static void
+MarkRectifierFrame(JSTracer *trc, const IonFrameIterator &frame)
+{
+    // Mark thisv. Baseline JIT code generated as part of the ICCall_Fallback
+    // stub may read it if a constructor returns a primitive value.
+    IonRectifierFrameLayout *layout = (IonRectifierFrameLayout *)frame.fp();
+    gc::MarkValueRoot(trc, &layout->argv()[0], "ion-thisv");
+}
+
 static void
 MarkJitActivation(JSTracer *trc, const JitActivationIterator &activations)
 {
@@ -1132,6 +1141,8 @@ MarkJitActivation(JSTracer *trc, const JitActivationIterator &activations)
           case IonFrame_Unwound_OptimizedJS:
             MOZ_ASSUME_UNREACHABLE("invalid");
           case IonFrame_Rectifier:
+            MarkRectifierFrame(trc, frames);
+            break;
           case IonFrame_Unwound_Rectifier:
             break;
           case IonFrame_Osr: