diff --git a/js/src/jit-test/tests/basic/bug653262.js b/js/src/jit-test/tests/basic/bug653262.js new file mode 100644 index 00000000000..92d0c69c172 --- /dev/null +++ b/js/src/jit-test/tests/basic/bug653262.js @@ -0,0 +1,6 @@ +var HAVE_TM = 'tracemonkey' in this; +var HOTLOOP = HAVE_TM ? tracemonkey : 8; +with(evalcx(''))(function eval() {}, this.__defineGetter__("x", Function)); +var i = 0; +var o; +new(x); diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp index 1dfef15f5dd..4c48d9ed332 100644 --- a/js/src/jsinterp.cpp +++ b/js/src/jsinterp.cpp @@ -656,7 +656,7 @@ Invoke(JSContext *cx, const CallArgs &argsRef, ConstructOption option) JSScript *script = fun->script(); if (JS_UNLIKELY(script->isEmpty())) { if (option == INVOKE_CONSTRUCTOR) { - bool newType = cx->typeInferenceEnabled() && + bool newType = cx->typeInferenceEnabled() && cx->fp()->isScriptFrame() && UseNewType(cx, cx->fp()->script(), cx->regs().pc); JSObject *obj = js_CreateThisForFunction(cx, &callee, newType); if (!obj)