From 34f1ba936816b38064736ee659877a3c8d41c160 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 29 Jan 2013 07:03:38 -0700
Subject: [PATCH] Bug 835496 - Don't try to fix the types for object
 initializers with dense elements, r=jandem.

---
 js/src/jit-test/tests/ion/bug835496.js | 6 ++++++
 js/src/jsinfer.cpp                     | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/ion/bug835496.js

diff --git a/js/src/jit-test/tests/ion/bug835496.js b/js/src/jit-test/tests/ion/bug835496.js
new file mode 100644
index 00000000000..0c40c0106c2
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug835496.js
@@ -0,0 +1,6 @@
+// |jit-test| error: TypeError
+
+(function([{x}]) {})({
+    t: 0,
+    "1": 0
+})
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 910d5c8a7c1..24b2eaa6311 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3248,7 +3248,7 @@ TypeCompartment::fixObjectType(JSContext *cx, HandleObject obj)
      */
     JS_ASSERT(obj->isObject());
 
-    if (obj->slotSpan() == 0 || obj->inDictionaryMode())
+    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements())
         return;
 
     ObjectTypeTable::AddPtr p = objectTypeTable->lookupForAdd(obj.get());