[INFER] Avoid spurious censoring of type barriers on writes of 'undefined' to singleton objects, bug 682345.

js/src/jit-test/tests/jaeger/bug682345.js

@@ -0,0 +1,15 @@
+
+for (var i = 0; i <= 0x017f; i++) {
+    var U = new Unicode(i);
+}
+function Unicode(c) {
+    u = GetUnicodeValues(c);
+    this.upper = u[0];
+}
+function GetUnicodeValues(c) {
+    u = new Array();
+    if ((c >= 0x0100 && c < 0x0138) || (c > 0x0149 && c < 0x0178)) try {} finally {
+        return;
+    }
+    return u;
+}

js/src/jsinfer.cpp

@@ -2262,7 +2262,7 @@ ScriptAnalysis::addTypeBarrier(JSContext *cx, const jsbytecode *pc, TypeSet *tar
     /* Ignore duplicate barriers. */
     TypeBarrier *barrier = code.typeBarriers;
     while (barrier) {
-        if (barrier->target == target && barrier->type == type)
+        if (barrier->target == target && barrier->type == type && !barrier->singleton)
             return;
         barrier = barrier->next;
     }