[INFER] Look up .prototype on right object when monitoring NEW, bug 621126.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 23 Dec 2010 20:31:24 -0500
changeset 74690 4f133dc20ac717cd6e81539f24398fb148dab93b
parent 74689 32d51249b97cab20aafb2b66f7105492ff472b1d
child 74691 f405f5f83fbe3b0a13bf74514758da7035536e40
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs621126
milestone2.0b8pre
[INFER] Look up .prototype on right object when monitoring NEW, bug 621126.
js/src/jit-test/tests/basic/testNewWithClone.js
js/src/jsinferinlines.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testNewWithClone.js
@@ -0,0 +1,7 @@
+with({}) {
+    function f() {
+        this.foo = "bar";
+    }
+    o = new f();
+    assertEq(o.foo, "bar");
+}
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -392,17 +392,18 @@ JSContext::typeMonitorCall(JSScript *cal
     if (!force)
         return;
 
     js::analyze::Script *script = callee->script()->analysis;
     js::types::jstype type;
 
     if (constructing) {
         js::Value protov;
-        if (!callee->getProperty(this, ATOM_TO_JSID(runtime->atomState.classPrototypeAtom), &protov))
+        jsid id = ATOM_TO_JSID(runtime->atomState.classPrototypeAtom);
+        if (!args.callee().toObject().getProperty(this, id, &protov))
             return;  /* :FIXME: */
         if (protov.isObject()) {
             js::types::TypeObject *otype = protov.toObject().getNewType(this);
             if (!otype)
                 return;  /* :FIXME: */
             type = (js::types::jstype) otype;
         } else {
             type = (js::types::jstype) getTypeNewObject(JSProto_Object);