From 183ab27e9d76b6150ff559523ea3c5fe32e97e76 Mon Sep 17 00:00:00 2001
From: Andreas Gal <gal@mozilla.com>
Date: Tue, 16 Sep 2008 18:49:27 -0700
Subject: [PATCH] Use Object as prototype if the prototype of the constructor
 is primitive (452960, r=mrbkap).

---
 js/src/jsbuiltins.cpp | 21 ++++++++++++++-------
 js/src/trace-test.js  |  9 +++++++++
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/js/src/jsbuiltins.cpp b/js/src/jsbuiltins.cpp
index 2645b7ff09e..c78e1f87585 100644
--- a/js/src/jsbuiltins.cpp
+++ b/js/src/jsbuiltins.cpp
@@ -624,11 +624,6 @@ js_FastNewObject(JSContext* cx, JSObject* ctor)
     JSClass* clasp = FUN_INTERPRETED(fun) ? &js_ObjectClass : fun->u.n.clasp;
     JS_ASSERT(clasp != &js_ArrayClass);
 
-    JS_ASSERT(JS_ON_TRACE(cx));
-    JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
-    if (!obj)
-        return NULL;
-
     JS_LOCK_OBJ(cx, ctor);
     JSScope *scope = OBJ_SCOPE(ctor);
     JS_ASSERT(scope->object == ctor);
@@ -639,8 +634,20 @@ js_FastNewObject(JSContext* cx, JSObject* ctor)
     jsval v = LOCKED_OBJ_GET_SLOT(ctor, sprop->slot);
     JS_UNLOCK_SCOPE(cx, scope);
 
-    JS_ASSERT(!JSVAL_IS_PRIMITIVE(v));
-    JSObject* proto = JSVAL_TO_OBJECT(v);
+    JSObject* proto;
+    if (JSVAL_IS_PRIMITIVE(v)) {
+        if (!js_GetClassPrototype(cx, JSVAL_TO_OBJECT(ctor->fslots[JSSLOT_PARENT]), 
+                                  INT_TO_JSID(JSProto_Object), &proto)) {
+            return NULL;
+        }
+    } else {
+        proto = JSVAL_TO_OBJECT(v);
+    }
+
+    JS_ASSERT(JS_ON_TRACE(cx));
+    JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
+    if (!obj)
+        return NULL;
 
     obj->classword = jsuword(clasp);
     obj->fslots[JSSLOT_PROTO] = OBJECT_TO_JSVAL(proto);
diff --git a/js/src/trace-test.js b/js/src/trace-test.js
index 8463cf235a2..1d8dc0500c7 100644
--- a/js/src/trace-test.js
+++ b/js/src/trace-test.js
@@ -1339,6 +1339,15 @@ function testSetPropNeitherMissNorHit() {
 testSetPropNeitherMissNorHit.expected = "ok";
 test(testSetPropNeitherMissNorHit);
 
+function testPrimitiveConstructorPrototype() {
+    var f = function(){};
+    f.prototype = false;
+    for (let j=0;j<5;++j) { new f; }
+    return "ok";
+}    
+testPrimitiveConstructorPrototype.expected = "ok";
+test(testPrimitiveConstructorPrototype);
+
 /* Keep these at the end so that we can see the summary after the trace-debug spew. */
 print("\npassed:", passes.length && passes.join(","));
 print("\nFAILED:", fails.length && fails.join(","));