Bug 764148 - Stop incorrectly shadowing TI properties on sets if a setter would

be called. r=bhackett

js/src/jsinferinlines.h

@@ -1260,8 +1260,36 @@ TypeObject::getProperty(JSContext *cx, jsid id, bool assign)
 
     TypeSet *types = &(*pprop)->types;
 
-    if (assign)
-        types->setOwnProperty(cx, false);
+    if (assign && !types->isOwnProperty(false)) {
+        /*
+         * Normally, we just want to set the property as being an own property
+         * when we got a set to it. The exception is when the set is actually
+         * calling a setter higher on the prototype chain. Check to see if there
+         * is a setter higher on the prototype chain, setter the property as an
+         * own property if that is not the case.
+         */
+        bool foundSetter = false;
+
+        JSObject *protoWalk = proto;
+        while (protoWalk) {
+            if (!protoWalk->isNative()) {
+                protoWalk = protoWalk->getProto();
+                continue;
+            }
+
+            const Shape *shape = protoWalk->nativeLookup(cx, id);
+
+            foundSetter = shape &&
+                          !shape->hasDefaultSetter();
+            if (foundSetter)
+                break;
+
+            protoWalk = protoWalk->getProto();
+        }
+
+        if (!foundSetter)
+            types->setOwnProperty(cx, false);
+    }
 
     return types;
 }