[INFER] Add read barrier for shapes with non-standard getters, bug 653639.

dom/base/nsDOMClassInfo.cpp

@@ -5240,9 +5240,6 @@ nsWindowSH::GlobalScopePolluterGetProperty(JSContext *cx, JSObject *obj,
   // catch and fix these mistakes.
   PrintWarningOnConsole(cx, "GlobalScopeElementReference");
 
-  // Update the object's type information with this property.
-  JS_AddTypePropertyId(cx, obj, id, *vp);
-
   return JS_TRUE;
 }
 

js/src/jsapi.cpp

@@ -3473,12 +3473,6 @@ JS_DefinePropertyWithTinyId(JSContext *cx, JSObject *obj, const char *name, int8
                           Valueify(setter), attrs, Shape::HAS_SHORTID, tinyid);
 }
 
-JS_PUBLIC_API(void)
-JS_AddTypePropertyId(JSContext *cx, JSObject *obj, jsid id, jsval value)
-{
-    cx->addTypePropertyId(obj->getType(), id, Valueify(value));
-}
-
 static JSBool
 DefineUCProperty(JSContext *cx, JSObject *obj, const jschar *name, size_t namelen,
                  const Value &value, PropertyOp getter, StrictPropertyOp setter, uintN attrs,

js/src/jsapi.h

@@ -2338,9 +2338,6 @@ JS_DefinePropertyWithTinyId(JSContext *cx, JSObject *obj, const char *name,
                             JSPropertyOp getter, JSStrictPropertyOp setter,
                             uintN attrs);
 
-JS_PUBLIC_API(void)
-JS_AddTypePropertyId(JSContext *cx, JSObject *obj, jsid id, jsval value);
-
 extern JS_PUBLIC_API(JSBool)
 JS_AliasProperty(JSContext *cx, JSObject *obj, const char *name,
                  const char *alias);

js/src/jsobj.cpp

@@ -5628,7 +5628,9 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
         pobj->nativeSetSlot(slot, *vp);
     }
 
-    JS_ASSERT(TypeHasProperty(cx, obj->getType(), shape->id, *vp));
+    if (!cx->addTypePropertyId(obj->getType(), shape->id, *vp))
+        return false;
+
     return true;
 }