From dfdfb5e88723e2eb62e1ce1671ce18644b9841f9 Mon Sep 17 00:00:00 2001
From: Brian Hackett <none@none>
Date: Tue, 14 Sep 2010 14:28:55 -0700
Subject: [PATCH] Fix assert, bug 595921. r=dmandelin

---
 js/src/methodjit/PolyIC.cpp                 | 13 +++++++++++--
 js/src/trace-test/tests/jaeger/bug595921.js |  9 +++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 js/src/trace-test/tests/jaeger/bug595921.js

diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 93ecb373d6a9..4cf96f4ab2a3 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -562,6 +562,15 @@ class SetPropCompiler : public PICStubCompiler
         if (obj->sealed())
             return disable("sealed");
 
+        Class *clasp = obj->getClass();
+
+        if (clasp->setProperty != PropertyStub)
+            return disable("set property hook");
+        if (clasp->ops.lookupProperty)
+            return disable("ops lookup property hook");
+        if (clasp->ops.setProperty)
+            return disable("ops set property hook");
+
 #ifdef JS_THREADSAFE
         if (!CX_OWNS_OBJECT_TITLE(f.cx, obj))
             return disable("shared object");
@@ -601,10 +610,10 @@ class SetPropCompiler : public PICStubCompiler
             if (obj->isDelegate())
                 return disable("delegate");
 
-            Class *clasp = obj->getClass();
-
             if (clasp->addProperty != PropertyStub)
                 return disable("add property hook");
+            if (clasp->ops.defineProperty)
+                return disable("ops define property hook");
 
             uint32 index;
             if (js_IdIsIndex(id, &index))
diff --git a/js/src/trace-test/tests/jaeger/bug595921.js b/js/src/trace-test/tests/jaeger/bug595921.js
new file mode 100644
index 000000000000..a5113adcb241
--- /dev/null
+++ b/js/src/trace-test/tests/jaeger/bug595921.js
@@ -0,0 +1,9 @@
+/* Don't assert. */
+x = <x/>
+function f(aaa) {
+    aaa.e = x
+}
+for each(let c in [x, x, x]) {
+    f(c)
+}
+assertEq(0,0);