From 17e72bfe5a730b07e52c55f500b7635c992253fc Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 8 Jan 2013 16:51:43 -0800
Subject: [PATCH] Bug 822858. r=billm

---
 js/src/builtin/RegExp.cpp | 11 -----------
 js/src/jsinfer.cpp        | 12 ++++++++++++
 js/src/jsstr.cpp          |  6 ------
 3 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index 90cf536d65d8..aac67fe8a320 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -533,17 +533,6 @@ js_InitRegExpClass(JSContext *cx, HandleObject obj)
     if (!JS_DefineProperties(cx, ctor, regexp_static_props))
         return NULL;
 
-    /* Capture normal data properties pregenerated for RegExp objects. */
-    TypeObject *type = proto->getNewType(cx);
-    if (!type)
-        return NULL;
-    AddTypeProperty(cx, type, "source", Type::StringType());
-    AddTypeProperty(cx, type, "global", Type::BooleanType());
-    AddTypeProperty(cx, type, "ignoreCase", Type::BooleanType());
-    AddTypeProperty(cx, type, "multiline", Type::BooleanType());
-    AddTypeProperty(cx, type, "sticky", Type::BooleanType());
-    AddTypeProperty(cx, type, "lastIndex", Type::Int32Type());
-
     if (!DefineConstructorAndPrototype(cx, global, JSProto_RegExp, ctor, proto))
         return NULL;
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 752dc58d9afa..9c4a5b50d635 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -5943,6 +5943,18 @@ JSCompartment::getNewType(JSContext *cx, TaggedProto proto_, JSFunction *fun_, b
         if (obj->isXML() && !type->unknownProperties())
             type->flags |= OBJECT_FLAG_UNKNOWN_MASK;
 #endif
+
+        if (obj->isRegExp()) {
+            AddTypeProperty(cx, type, "source", types::Type::StringType());
+            AddTypeProperty(cx, type, "global", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "ignoreCase", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "multiline", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "sticky", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "lastIndex", types::Type::Int32Type());
+        }
+
+        if (obj->isString())
+            AddTypeProperty(cx, type, "length", Type::Int32Type());
     }
 
     /*
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index b98449d73d82..1e7ce6f3b2ed 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -3346,12 +3346,6 @@ js_InitStringClass(JSContext *cx, HandleObject obj)
         return NULL;
     }
 
-    /* Capture normal data properties pregenerated for String objects. */
-    TypeObject *type = proto->getNewType(cx);
-    if (!type)
-        return NULL;
-    AddTypeProperty(cx, type, "length", Type::Int32Type());
-
     if (!DefineConstructorAndPrototype(cx, global, JSProto_String, ctor, proto))
         return NULL;