mozilla-inbound: changeset 146462:a512b89b44ebe2c006f40deb1a0dd59f4e73d485

author	Eric Faust <efaustbmo@gmail.com>
	Tue, 10 Sep 2013 16:01:36 -0700
changeset 146462	a512b89b44ebe2c006f40deb1a0dd59f4e73d485
parent 146461	7412a3a5f4cceea99d3677fd2526975f9198fd83
child 146463	d0a0127e099e03a7ff9ad32b8616260b19a09429
push id	33563
push user	efaustbmo@gmail.com
push date	Tue, 10 Sep 2013 23:06:49 +0000
treeherder	mozilla-inbound@a512b89b44eb [default view] [failures only]
perfherder	[talos] [build metrics] [platform microbench] (compared to previous push)
reviewers	djvj
bugs	913716
milestone	26.0a1
first release with	nightly linux32 9e9f74116749 / 26.0a1 / 20130911030258 / files nightly linux64 9e9f74116749 / 26.0a1 / 20130911030258 / files nightly mac 9e9f74116749 / 26.0a1 / 20130911030258 / files nightly win32 9e9f74116749 / 26.0a1 / 20130911030258 / files nightly win64 9e9f74116749 / 26.0a1 / 20130911030258 / files
last release without	nightly linux32 e5ca10a2b3d0 / 26.0a1 / 20130910030254 / files nightly linux64 e5ca10a2b3d0 / 26.0a1 / 20130910030254 / files nightly mac e5ca10a2b3d0 / 26.0a1 / 20130910030254 / files nightly win32 e5ca10a2b3d0 / 26.0a1 / 20130910030254 / files nightly win64 e5ca10a2b3d0 / 26.0a1 / 20130910030254 / files

--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -2019,17 +2019,18 @@ static bool
 IsCacheableSetPropCallNative(HandleObject obj, HandleObject holder, HandleShape shape)
 {
     if (!obj->isNative())
         return false;
 
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
-    return shape->hasSetterValue() && shape->setterObject()->is<JSFunction>() &&
+    return shape->hasSetterValue() && shape->setterObject() &&
+           shape->setterObject()->is<JSFunction>() &&
            shape->setterObject()->as<JSFunction>().isNative();
 }
 
 static bool
 IsCacheableSetPropCallPropertyOp(HandleObject obj, HandleObject holder,
                                  HandleShape shape)
 {
     if (!obj->isNative())