Don't generate addprop PIC for JSOP_SETNAME, bug 735161. r=dvander

js/src/jit-test/tests/jaeger/bug735161.js

@@ -0,0 +1,4 @@
+var obj = {valueOf: function() { "use strict"; undeclared = 7; }};
+try { '' + obj; assertEq(true, false); } catch(e) { }
+try { '' + obj; assertEq(true, false); } catch(e) { }
+assertEq("undeclared" in this, false);

js/src/methodjit/PolyIC.cpp

@@ -561,6 +561,13 @@ class SetPropCompiler : public PICStubCompiler
             if (clasp->ops.defineProperty)
                 return disable("ops define property hook");
 
+            /*
+             * Don't add properties for SETNAME, which requires checks in
+             * strict mode code.
+             */
+            if (JSOp(*f.pc()) == JSOP_SETNAME)
+                return disable("add property under SETNAME");
+
             /*
              * When adding a property we need to check shapes along the entire
              * prototype chain to watch for an added setter.