Watch for typed array prototypes when making filling in type information for singletons, bug 769433. r=dvander

js/src/jit-test/tests/basic/bug769433.js

@@ -0,0 +1,8 @@
+
+function stringConvert() {
+  var a = Uint32Array.prototype;
+  for (var i = 0; i < 10; i++) {
+    a[0] = i;
+  }
+}
+stringConvert();

js/src/jsinfer.cpp

@@ -5584,9 +5584,17 @@ JSObject::makeLazyType(JSContext *cx)
     if (getClass()->ext.equality)
         type->flags |= OBJECT_FLAG_SPECIAL_EQUALITY;
 
+    /*
+     * Adjust flags for objects which will have the wrong flags set by just
+     * looking at the class prototype key.
+     */
+
     if (isSlowArray())
         type->flags |= OBJECT_FLAG_NON_DENSE_ARRAY | OBJECT_FLAG_NON_PACKED_ARRAY;
 
+    if (IsTypedArrayProto(this))
+        type->flags |= OBJECT_FLAG_NON_TYPED_ARRAY;
+
     type_ = type;
 }