Only inline construction of 'this' for 'new' on singleton functions, bug 706110. r=billm

This commit is contained in:
Brian Hackett 2011-11-29 13:26:37 -08:00
parent d6eecb8cad
commit 141d85d850
2 changed files with 23 additions and 1 deletions

View File

@ -0,0 +1,18 @@
function test() {
function Bug() { this.prototype }
var actual = (new Bug instanceof Bug);
assertEq(actual, true);
}
test();
test();
function testLambdaCtor() {
var q;
for (var x = 0; x < 2; ++x) {
var f = function(){};
if (x == 1) gc();
q = new f;
}
return q.__proto__ === f.prototype;
}
assertEq(testLambdaCtor(), true);

View File

@ -7272,8 +7272,12 @@ mjit::Compiler::constructThis()
JSFunction *fun = script->function();
do {
if (!cx->typeInferenceEnabled() || fun->getType(cx)->unknownProperties())
if (!cx->typeInferenceEnabled() ||
!fun->hasSingletonType() ||
fun->getType(cx)->unknownProperties())
{
break;
}
jsid id = ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom);
types::TypeSet *protoTypes = fun->getType(cx)->getProperty(cx, id, false);