Guard that object is a dense array when skipping to its prototype during property lookup (485790, r=brendan).

js/src/jstracer.cpp

@@ -5711,6 +5711,7 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
     // typically to find Array.prototype methods.
     JSObject* aobj = obj;
     if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
+        guardDenseArray(obj, obj_ins, BRANCH_EXIT);
         aobj = OBJ_GET_PROTO(cx, obj);
         obj_ins = stobj_get_fslot(obj_ins, JSSLOT_PROTO);
     }

js/src/trace-test.js

@@ -4760,6 +4760,19 @@ function testWhileObjectOrNull()
 testWhileObjectOrNull.expected = "pass";
 test(testWhileObjectOrNull);
 
+function testDenseArrayProp()
+{
+    [].__proto__.x = 1;
+    ({}).__proto__.x = 2;
+    var a = [[],[],[],({}).__proto__];
+    for (var i = 0; i < a.length; ++i)
+        uneval(a[i].x);
+    delete [].__proto__.x;
+    delete ({}).__proto__.x;
+    return "ok";
+}
+testDenseArrayProp.expected = "ok";
+test(testDenseArrayProp);
 
 /*****************************************************************************
  *                                                                           *
@@ -5073,4 +5086,4 @@ test(testGlobalProtoAccess);
 if (gReportSummary) {
     print("\npassed:", passes.length && passes.join(","));
     print("\nFAILED:", fails.length && fails.join(","));
- }
+}