Bug 857576 - Make sure isOwnProperty() method of the input typeset's single typeobject's property typeset is run before main body of IonBuilder::jsop_getprop method. r=bhackett

js/src/ion/BaselineIC.h

@@ -3635,7 +3635,9 @@ class ICGetIntrinsic_Constant : public ICStub
     {}
 
   public:
-    static inline ICGetIntrinsic_Constant *New(ICStubSpace *space, IonCode *code, HandleValue value) {
+    static inline ICGetIntrinsic_Constant *New(ICStubSpace *space, IonCode *code,
+                                               HandleValue value)
+    {
         if (!code)
             return NULL;
         return space->allocate<ICGetIntrinsic_Constant>(code, value);

js/src/ion/IonBuilder.cpp

@@ -6652,6 +6652,11 @@ IonBuilder::jsop_getprop(HandlePropertyName name)
 {
     RootedId id(cx, NameToId(name));
 
+    // GetDefiniteSlot may cause type information to shift, and it's done inside
+    // getPropTryDefiniteSlot.  Do it here first to ensure that all type info changes
+    // occur before handling the op.
+    GetDefiniteSlot(cx, oracle->unaryTypes(script(), pc).inTypes, name);
+
     RootedScript scriptRoot(cx, script());
     types::StackTypeSet *barrier = oracle->propertyReadBarrier(scriptRoot, pc);
     types::StackTypeSet *types = oracle->propertyRead(script(), pc);