Bug 789735 - Handle lazily-created TypeObjects in IonBuilder. r=dvander

This commit is contained in:
Sean Stangl 2012-09-10 15:13:38 -07:00
parent 3f7ddc83c6
commit b1bb1d6ec3

View File

@ -5611,10 +5611,10 @@ IonBuilder::annotateGetPropertyCache(JSContext *cx, MDefinition *obj, MGetProper
if (!TestSingletonProperty(cx, proto, id, &knownConstant))
return false;
if (!knownConstant || proto->type()->unknownProperties())
if (!knownConstant || proto->getType(cx)->unknownProperties())
continue;
types::HeapTypeSet *protoTypes = proto->type()->getProperty(cx, id, false);
types::HeapTypeSet *protoTypes = proto->getType(cx)->getProperty(cx, id, false);
if (!protoTypes)
continue;