Bug 980119 - Watch for typed arrays with unknown properties when baking in their elements, r=jandem.

js/src/jit-test/tests/ion/bug980119.js

@@ -0,0 +1,9 @@
+
+s = newGlobal()
+evalcx("\
+    x = new Uint8ClampedArray;\
+    x.__proto__ = [];\
+", s);
+evalcx("\
+    x[0]\
+", s);

js/src/jit/IonBuilder.cpp

@@ -7181,12 +7181,14 @@ IonBuilder::getTypedArrayElements(MDefinition *obj)
             // The 'data' pointer can change in rare circumstances
             // (ArrayBufferObject::changeContents).
             types::TypeObjectKey *tarrType = types::TypeObjectKey::get(tarr);
+            if (!tarrType->unknownProperties()) {
                 tarrType->watchStateChangeForTypedArrayBuffer(constraints());
 
                 obj->setImplicitlyUsedUnchecked();
                 return MConstantElements::New(alloc(), data);
             }
         }
+    }
     return MTypedArrayElements::New(alloc(), obj);
 }