[tbb-commits] [tor-browser/esr24] Bug 1054359 - Add is-object check to IonBuilder::makeCallHelper. r=efaust, a=abillings

[mikeperry at torproject.org]

commit 7ea61dd2364ac3ce359b8cb64b8945a51be49875
Author: Jan de Mooij <jdemooij at mozilla.com>
Date:   Mon Aug 18 12:03:55 2014 +0200

    Bug 1054359 - Add is-object check to IonBuilder::makeCallHelper. r=efaust, a=abillings
---
 js/src/jit/IonBuilder.cpp |    1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 2ceaf71..e0d3ef6 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -5005,6 +5005,7 @@ IonBuilder::makeCallHelper(HandleFunction target, CallInfo &callInfo, bool clone
         // MCall accordingly.
         types::StackTypeSet *thisTypes = thisArg->resultTypeSet();
         if (thisTypes &&
+            thisTypes->getKnownTypeTag() == JSVAL_TYPE_OBJECT &&
             TestAreKnownDOMTypes(cx, thisTypes) &&
             TestShouldDOMCall(cx, thisTypes, target, JSJitInfo::Method))
         {