[INFER] Add object test when statically walking the prototype chain for CALLPROP, bug 645985.
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 29 Mar 2011 15:57:38 -0700
changeset 74864 cfeb40109a60c284b7c8471fb2363253c0b5c818
parent 74863 f6a77f725bbca8a3b25038a400c092cf9b2645fa
child 74865 2d030f5157e584940335880a3a5d99d05796d13f
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs645985
milestone2.0b13pre
[INFER] Add object test when statically walking the prototype chain for CALLPROP, bug 645985.
js/src/jit-test/tests/jaeger/bug645985.js
js/src/methodjit/Compiler.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug645985.js
@@ -0,0 +1,5 @@
+function f(o) {
+    o += "";
+    o.hasOwnProperty("x");
+}
+f({});
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -4471,17 +4471,17 @@ mjit::Compiler::testSingletonPropertyTyp
         break;
 
       case JSVAL_TYPE_BOOLEAN:
         key = JSProto_Boolean;
         break;
 
       case JSVAL_TYPE_OBJECT:
       case JSVAL_TYPE_UNKNOWN:
-        if (types->objectCount == 1) {
+        if (types->objectCount == 1 && !top->isNotType(JSVAL_TYPE_OBJECT)) {
             JS_ASSERT_IF(top->isTypeKnown(), top->isType(JSVAL_TYPE_OBJECT));
             types::TypeObject *object = (types::TypeObject *) types->objectSet;
             if (object->proto) {
                 if (!testSingletonProperty(object->proto, id))
                     return false;
 
                 /* If we don't know this is an object, we will need a test. */
                 *testObject = (type != JSVAL_TYPE_OBJECT) && !top->isTypeKnown();