Bug 945294 - Add a missing is<JSFunction> check to annotateGetPropertyCache. r=bhackett

--HG--
extra : rebase_source : 908712a8afa11ce5ce32311befba30edd86a6128

js/src/jit-test/tests/ion/bug945294.js

@@ -0,0 +1,22 @@
+// |jit-test| error:is not a function
+var arr = [];
+
+var C = function () {};
+C.prototype.dump = function () {};
+arr[0] = new C;
+
+C = function () {};
+C.prototype.dump = this;
+arr[1] = new C;
+
+function f() {
+    for (var i = 0; i < arr.length; i++)
+        arr[i].dump();
+}
+
+try {
+    f();
+} catch (exc) {
+    assertEq(exc.message.contains("is not a function"), true);
+}
+f();

js/src/jit/IonBuilder.cpp

@@ -8003,7 +8003,7 @@ IonBuilder::annotateGetPropertyCache(MDefinition *obj, MGetPropertyCache *getPro
             continue;
 
         JSObject *singleton = testSingletonProperty(typeObj->proto().toObject(), name);
-        if (!singleton)
+        if (!singleton || !singleton->is<JSFunction>())
             continue;
 
         // Don't add cases corresponding to non-observed pushes