commit 7ea61dd2364ac3ce359b8cb64b8945a51be49875 Author: Jan de Mooij jdemooij@mozilla.com Date: Mon Aug 18 12:03:55 2014 +0200

Bug 1054359 - Add is-object check to IonBuilder::makeCallHelper. r=efaust, a=abillings --- js/src/jit/IonBuilder.cpp | 1 + 1 file changed, 1 insertion(+)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 2ceaf71..e0d3ef6 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -5005,6 +5005,7 @@ IonBuilder::makeCallHelper(HandleFunction target, CallInfo &callInfo, bool clone // MCall accordingly. types::StackTypeSet *thisTypes = thisArg->resultTypeSet(); if (thisTypes && + thisTypes->getKnownTypeTag() == JSVAL_TYPE_OBJECT && TestAreKnownDOMTypes(cx, thisTypes) && TestShouldDOMCall(cx, thisTypes, target, JSJitInfo::Method)) {