[INFER] Scan entire prototype chain for a lookupProperty hook when nop-ing accesses on singleton objects, bug 673788.

js/src/jit-test/tests/jaeger/bug673788.js

@@ -0,0 +1,10 @@
+// |jit-test| error: ReferenceError
+p = Proxy.create({
+  has: function() {}
+})
+Object.prototype.__proto__ = p
+n = [];
+(function() {
+  var a = [];
+  if (b) t = a.s()
+})()

js/src/methodjit/Compiler.cpp

@@ -4622,10 +4622,14 @@ mjit::Compiler::testSingletonProperty(JSObject *obj, jsid id)
      * properties to be explicitly marked with undefined.
      */
 
-    if (!obj->isNative())
-        return false;
-    if (obj->getClass()->ops.lookupProperty)
-        return false;
+    JSObject *nobj = obj;
+    while (nobj) {
+        if (!nobj->isNative())
+            return false;
+        if (nobj->getClass()->ops.lookupProperty)
+            return false;
+        nobj = nobj->getProto();
+    }
 
     JSObject *holder;
     JSProperty *prop = NULL;