Bug 927195 - Track prototype properties of functions used in instanceof operations, r=jandem.

This commit is contained in:
Brian Hackett 2013-10-16 12:27:02 -06:00
parent 77fbf1392d
commit e0630ec7c3

View File

@ -8845,6 +8845,11 @@ DoInstanceOfFallback(JSContext *cx, ICInstanceOf_Fallback *stub,
RootedObject obj(cx, &rhs.toObject());
// For functions, keep track of the |prototype| property in type information,
// for use during Ion compilation.
if (obj->is<JSFunction>() && IsIonEnabled(cx))
types::EnsureTrackPropertyTypes(cx, obj, NameToId(cx->names().prototype));
bool cond = false;
if (!HasInstance(cx, obj, lhs, &cond))
return false;