From 140d584eedb54033c65fe70c94655c1d95474e5c Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 20 Mar 2011 10:47:47 -0700
Subject: [PATCH] [INFER] Avoid constructing unnecessary FreezeObjectKind
 constraints, bug 643249.

---
 js/src/jit-test/tests/basic/bug643249.js | 13 +++++++++++++
 js/src/jsinfer.cpp                       | 22 ++++++++++++----------
 2 files changed, 25 insertions(+), 10 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/bug643249.js

diff --git a/js/src/jit-test/tests/basic/bug643249.js b/js/src/jit-test/tests/basic/bug643249.js
new file mode 100644
index 00000000000..79f321d0f64
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug643249.js
@@ -0,0 +1,13 @@
+{
+    function x() {}
+}
+for (i = 0; i < 10; i++) {
+    _someglobal_ = /a/;
+    (function() {
+        return function() {
+            return _someglobal_
+        } ()
+    } () == /a/);
+    gc();
+    _someglobal_ = new Function.__lookupSetter__;
+}
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 2f098bf9b20..d2f0804dab0 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1465,16 +1465,18 @@ public:
             TypeObject *object = (TypeObject *) type;
             ObjectKind nkind = CombineObjectKind(object, kind);
 
-            /*
-             * Add a constraint on the element type of the object to pick up
-             * changes in the object's array-ness or any unknown properties.
-             */
-            TypeSet *elementTypes = object->getProperty(cx, JSID_VOID, false);
-            if (!elementTypes)
-                return;
-            elementTypes->add(cx,
-                ArenaNew<TypeConstraintFreezeObjectKind>(cx->compartment->types.pool,
-                                                         object, &kind, script), false);
+            if (nkind != OBJECT_UNKNOWN) {
+                /*
+                 * Add a constraint on the element type of the object to pick up
+                 * changes in the object's array-ness or any unknown properties.
+                 */
+                TypeSet *elementTypes = object->getProperty(cx, JSID_VOID, false);
+                if (!elementTypes)
+                    return;
+                elementTypes->add(cx,
+                    ArenaNew<TypeConstraintFreezeObjectKind>(cx->compartment->types.pool,
+                                                             object, &kind, script), false);
+            }
 
             if (nkind == kind) {
                 /* New object with the same kind we are interested in. */