Check for uncacheable prototypes during ADDPROP IC, bug 704138.

js/src/jit-test/tests/jaeger/bug704138.js

@@ -0,0 +1,17 @@
+function TestCase(n, d, e, a)
+  this.name=n;
+function reportCompare (expected, actual, description) {
+  new TestCase
+}
+reportCompare(true, "isGenerator" in Function, "Function.prototype.isGenerator present");
+var p = Proxy.create({
+    has : function(id) {}
+});
+function test() {
+    Object.prototype.__proto__=null
+    if (new TestCase)
+        Object.prototype.__proto__=p
+}
+test();
+new TestCase;
+test()

js/src/methodjit/PolyIC.cpp

@@ -520,6 +520,17 @@ class SetPropCompiler : public PICStubCompiler
             if (js_IdIsIndex(id, &index))
                 return disable("index");
 
+            /*
+             * When adding a property we need to check shapes along the entire
+             * prototype chain to watch for an added setter.
+             */
+            JSObject *proto = obj;
+            while (proto) {
+                if (proto->hasUncacheableProto() || proto->isNative())
+                    return disable("non-cacheable proto");
+                proto = proto->getProto();
+            }
+
             const Shape *initialShape = obj->lastProperty();
             uint32 slots = obj->numDynamicSlots();