From 01a2274ce4049587e4197cf380a2c9c6da9db0d2 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 23 Dec 2010 20:31:24 -0500
Subject: [PATCH] [INFER] Look up .prototype on right object when monitoring
 NEW, bug 621126.

---
 js/src/jit-test/tests/basic/testNewWithClone.js | 7 +++++++
 js/src/jsinferinlines.h                         | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/basic/testNewWithClone.js

diff --git a/js/src/jit-test/tests/basic/testNewWithClone.js b/js/src/jit-test/tests/basic/testNewWithClone.js
new file mode 100644
index 00000000000..ef976df5858
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testNewWithClone.js
@@ -0,0 +1,7 @@
+with({}) {
+    function f() {
+        this.foo = "bar";
+    }
+    o = new f();
+    assertEq(o.foo, "bar");
+}
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index ec21986eed6..adacaa62e3a 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -397,7 +397,8 @@ JSContext::typeMonitorCall(JSScript *caller, const jsbytecode *callerpc,
 
     if (constructing) {
         js::Value protov;
-        if (!callee->getProperty(this, ATOM_TO_JSID(runtime->atomState.classPrototypeAtom), &protov))
+        jsid id = ATOM_TO_JSID(runtime->atomState.classPrototypeAtom);
+        if (!args.callee().toObject().getProperty(this, id, &protov))
             return;  /* :FIXME: */
         if (protov.isObject()) {
             js::types::TypeObject *otype = protov.toObject().getNewType(this);