Bug 996536 - Don't assume that all interpretedLazy functions have a lazyScript. r=bhackett
authorTill Schneidereit <till@tillschneidereit.net>
Fri, 25 Apr 2014 10:40:17 +0200
changeset 180479 4441b7c2b10b5f8eca60a1f4c67863c7f66652cf
parent 180478 e6eeddc2625aeda1932c7d664771ad5d9e029a1b
child 180480 3d116167774f8adc52caf2030f1d9328a64b274b
push id272
push userpvanderbeken@mozilla.com
push dateMon, 05 May 2014 16:31:18 +0000
reviewersbhackett
bugs996536
milestone31.0a1
Bug 996536 - Don't assume that all interpretedLazy functions have a lazyScript. r=bhackett
js/src/jsinfer.cpp
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3848,17 +3848,17 @@ ExclusiveContext::getNewType(const Class
 
     if (!newTypeObjects.initialized() && !newTypeObjects.init())
         return nullptr;
 
     // Canonicalize new functions to use the original one associated with its script.
     if (fun) {
         if (fun->hasScript())
             fun = fun->nonLazyScript()->functionNonDelazifying();
-        else if (fun->isInterpretedLazy())
+        else if (fun->isInterpretedLazy() && !fun->isSelfHostedBuiltin())
             fun = fun->lazyScript()->functionNonDelazifying();
         else
             fun = nullptr;
     }
 
     TypeObjectWithNewScriptSet::AddPtr p =
         newTypeObjects.lookupForAdd(TypeObjectWithNewScriptSet::Lookup(clasp, proto, fun));
     if (p) {