Bug 973238 Part 6 -- Consult prototype rather than typed object addendum r=bhackett

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Bug 973238 part 5 needs clobber due to self-hosted code (bug 1019955).
+Bug 973238 part 6 needs clobber due to self-hosted code (bug 1019955).

js/src/jit/IonBuilder.cpp

@@ -10264,14 +10264,20 @@ IonBuilder::typeSetToTypeDescrSet(types::TemporaryTypeSet *types,
     TypeDescrSetBuilder set;
     for (uint32_t i = 0; i < types->getObjectCount(); i++) {
         types::TypeObject *type = types->getTypeObject(i);
-        if (!type || type->unknownProperties())
+        if (!type)
             return true;
 
-        if (!type->hasTypedObject())
+        if (!IsTypedObjectClass(type->clasp()))
             return true;
 
-        TypeDescr &descr = type->typedObject()->descr();
+        TaggedProto proto = type->proto();
-        if (!set.insert(&descr))
+
+        // typed objects have immutable prototypes, and they are
+        // always instances of TypedProto
+        JS_ASSERT(proto.isObject() && proto.toObject()->is<TypedProto>());
+
+        TypedProto &typedProto = proto.toObject()->as<TypedProto>();
+        if (!set.insert(&typedProto.typeDescr()))
             return false;
     }