Bug 787847 - Missing property IC needs to check proto chain for proxies (r=luke)

js/src/jit-test/tests/basic/bug787847.js

@@ -0,0 +1,22 @@
+var g = true;
+
+function getown(name)
+{
+    if (g)
+	return { value: 8, enumerable: true, writable: false, configurable: true };
+}
+
+var p = Proxy.create( { getPropertyDescriptor: getown } );
+var o2 = Object.create(p);
+
+function test(x, expected) {
+    for (var i=0; i<3; i++) {
+	var v = x.hello;
+	if (g) assertEq(v, 8);
+    }
+}
+
+g = false
+test(o2);
+g = true;
+test(o2);

js/src/methodjit/PolyIC.cpp

@@ -702,8 +702,12 @@ struct GetPropHelper {
              * object, as lookups may extend beyond the prototype chain (e.g.
              * for ListBase proxies).
              */
-            if (!obj->isNative())
-                return Lookup_Uncacheable;
+            JSObject *obj2 = obj;
+            while (obj2) {
+                if (!obj2->isNative())
+                    return Lookup_Uncacheable;
+                obj2 = obj2->getProto();
+            }
 
 #if JS_HAS_NO_SUCH_METHOD
             /*