4 files changed, 51 insertions, 5 deletions

diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index fef6c0c78..d033d3706 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -51,6 +51,7 @@ const size_t ChunkMarkBitmapBits = 129024;
 const size_t ChunkRuntimeOffset = ChunkSize - sizeof(void*);
 const size_t ChunkTrailerSize = 2 * sizeof(uintptr_t) + sizeof(uint64_t);
 const size_t ChunkLocationOffset = ChunkSize - ChunkTrailerSize;
+const size_t ChunkStoreBufferOffset = ChunkSize - ChunkTrailerSize + sizeof(uint64_t);
 const size_t ArenaZoneOffset = sizeof(size_t);
 const size_t ArenaHeaderSize = sizeof(size_t) + 2 * sizeof(uintptr_t) +
                                sizeof(size_t) + sizeof(uintptr_t);
@@ -326,6 +327,20 @@ CellIsMarkedGray(const Cell* cell)
 extern JS_PUBLIC_API(bool)
 CellIsMarkedGrayIfKnown(const Cell* cell);
 
+MOZ_ALWAYS_INLINE ChunkLocation GetCellLocation(const void* cell) {
+  uintptr_t addr = uintptr_t(cell);
+  addr &= ~js::gc::ChunkMask;
+  addr |= js::gc::ChunkLocationOffset;
+  return *reinterpret_cast<ChunkLocation*>(addr);
+}
+
+MOZ_ALWAYS_INLINE bool NurseryCellHasStoreBuffer(const void* cell) {
+  uintptr_t addr = uintptr_t(cell);
+  addr &= ~js::gc::ChunkMask;
+  addr |= js::gc::ChunkStoreBufferOffset;
+  return *reinterpret_cast<void**>(addr) != nullptr;
+}
+
 } /* namespace detail */
 
 MOZ_ALWAYS_INLINE bool
@@ -341,6 +356,28 @@ IsInsideNursery(const js::gc::Cell* cell)
     return location == ChunkLocation::Nursery;
 }
 
+MOZ_ALWAYS_INLINE bool IsCellPointerValid(const void* cell) {
+  auto addr = uintptr_t(cell);
+  if (addr < ChunkSize || addr % CellSize != 0) {
+    return false;
+  }
+  auto location = detail::GetCellLocation(cell);
+  if (location == ChunkLocation::TenuredHeap) {
+    return !!detail::GetGCThingZone(addr);
+  }
+  if (location == ChunkLocation::Nursery) {
+    return detail::NurseryCellHasStoreBuffer(cell);
+  }
+  return false;
+}
+
+MOZ_ALWAYS_INLINE bool IsCellPointerValidOrNull(const void* cell) {
+  if (!cell) {
+    return true;
+  }
+  return IsCellPointerValid(cell);
+}
+
 } /* namespace gc */
 } /* namespace js */
 
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 43e325394..b4db0297a 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2267,6 +2267,8 @@ void
 js::gc::StoreBuffer::SlotsEdge::trace(TenuringTracer& mover) const
 {
     NativeObject* obj = object();
+    if(!IsCellPointerValid(obj))
+        return;
 
     // Beware JSObject::swap exchanging a native object for a non-native one.
     if (!obj->isNative())
@@ -2336,6 +2338,8 @@ js::gc::StoreBuffer::traceWholeCells(TenuringTracer& mover)
 {
     for (ArenaCellSet* cells = bufferWholeCell; cells; cells = cells->next) {
         Arena* arena = cells->arena;
+        if(!IsCellPointerValid(arena))
+            continue;
 
         MOZ_ASSERT(arena->bufferedCells == cells);
         arena->bufferedCells = &ArenaCellSet::Empty;
@@ -2364,6 +2368,7 @@ js::gc::StoreBuffer::CellPtrEdge::trace(TenuringTracer& mover) const
 {
     if (!*edge)
         return;
+    // XXX: We should check if the cell pointer is valid here too
 
     MOZ_ASSERT((*edge)->getTraceKind() == JS::TraceKind::Object);
     mover.traverse(reinterpret_cast<JSObject**>(edge));
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index f08baf865..3d0b73f04 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3823,7 +3823,7 @@ IonBuilder::improveTypesAtTypeOfCompare(MCompare* ins, bool trueBranch, MTest* t
         tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc());
     }
 
-    if (inputTypes->unknown())
+    if (inputTypes->unknown() || inputTypes->hasType(TypeSet::MagicArgType()))
         return true;
 
     // Note: we cannot remove the AnyObject type in the false branch,
@@ -3905,7 +3905,7 @@ IonBuilder::improveTypesAtNullOrUndefinedCompare(MCompare* ins, bool trueBranch,
         tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc());
     }
 
-    if (inputTypes->unknown())
+    if (inputTypes->unknown() || inputTypes->hasType(TypeSet::MagicArgType()))
         return true;
 
     TemporaryTypeSet* type;
@@ -3969,7 +3969,7 @@ IonBuilder::improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test)
             tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc());
         }
 
-        if (oldType->unknown())
+        if (oldType->unknown() || oldType->hasType(TypeSet::MagicArgType()))
             return true;
 
         TemporaryTypeSet* type = nullptr;
@@ -4049,7 +4049,7 @@ IonBuilder::improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test)
     }
 
     // If ins does not have a typeset we return as we cannot optimize.
-    if (oldType->unknown())
+    if (oldType->unknown() || oldType->hasType(TypeSet::MagicArgType()))
         return true;
 
     // Decide either to set or remove.
diff --git a/js/src/jit/Sink.cpp b/js/src/jit/Sink.cpp
index b2c36fae5..2764fc1cb 100644
--- a/js/src/jit/Sink.cpp
+++ b/js/src/jit/Sink.cpp
@@ -71,8 +71,12 @@ Sink(MIRGenerator* mir, MIRGraph& graph)
             for (MUseIterator i(ins->usesBegin()), e(ins->usesEnd()); i != e; i++) {
                 hasUses = true;
                 MNode* consumerNode = (*i)->consumer();
-                if (consumerNode->isResumePoint())
+                if (consumerNode->isResumePoint()) {
+                    if (!consumerNode->toResumePoint()->isRecoverableOperand(*i)) {
+                        hasLiveUses = true;
+                    }
                     continue;
+                }
 
                 MDefinition* consumer = consumerNode->toDefinition();
                 if (consumer->isRecoveredOnBailout())