Bug 730452 - Trigger post barriers on moveDenseArrayElements; r=billm

We cannot do this per-element because it is too slow.  Instead we have a special
storebuffer entry for this case so we can do all work at gc time.

--HG--
extra : rebase_source : 7e48184d38b442b2bdba38553cf93f9d629debf1

js/src/gc/Barrier.h

@@ -395,6 +395,17 @@ class HeapSlot : public EncapsulatedValue
     inline void post(JSCompartment *comp, JSObject *owner, uint32_t slot);
 };
 
+/*
+ * NOTE: This is a placeholder for bug 619558.
+ *
+ * Run a post write barrier that encompasses multiple contiguous slots in a
+ * single step.
+ */
+static inline void
+SlotRangeWriteBarrierPost(JSCompartment *comp, JSObject *obj, uint32_t start, uint32_t count)
+{
+}
+
 static inline const Value *
 Valueify(const EncapsulatedValue *array)
 {

js/src/jsobjinlines.h

@@ -511,6 +511,7 @@ JSObject::moveDenseArrayElements(unsigned dstStart, unsigned srcStart, unsigned
         }
     } else {
         memmove(elements + dstStart, elements + srcStart, count * sizeof(js::HeapSlot));
+        SlotRangeWriteBarrierPost(comp, this, dstStart, count);
     }
 }