Bug 389034 - JS_SetProperty() ends up resolving w/o JSRESOLVE_ASSIGNING (r=brendan, sr=bzbarsky)

dom/src/base/nsDOMClassInfo.cpp

@@ -5919,20 +5919,17 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
 #endif
 
       jsid interned_id;
-      JSObject *pobj;
+      JSObject *pobj = NULL;
-      JSProperty *prop = nsnull;
+      jsval val;
 
       *_retval = (::JS_ValueToId(cx, id, &interned_id) &&
-                  OBJ_LOOKUP_PROPERTY(cx, innerObj, interned_id, &pobj,
+                  ::JS_LookupPropertyByIdWithFlags(cx, innerObj, interned_id,
-                                      &prop));
+                                                   flags, &pobj, &val));
 
-      if (*_retval && prop) {
+      if (*_retval && pobj) {
 #ifdef DEBUG_SH_FORWARDING
         printf(" --- Resolve on inner window found property.\n");
 #endif
-
-        OBJ_DROP_PROPERTY(cx, pobj, prop);
-
         *objp = pobj;
       }
 
@@ -6411,8 +6408,9 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   // binding a name) a new undefined property that's not already
   // defined on our prototype chain. This way we can access this
   // expando w/o ever getting back into XPConnect.
-  if ((flags & (JSRESOLVE_ASSIGNING)) && cx->fp->regs &&
+  if ((flags & (JSRESOLVE_ASSIGNING)) &&
-      (JSOp)*cx->fp->regs->pc != JSOP_BINDNAME && win->IsInnerWindow()) {
+      !(cx->fp && cx->fp->regs && (JSOp)*cx->fp->regs->pc == JSOP_BINDNAME) &&
+      win->IsInnerWindow()) {
     JSObject *realObj;
     wrapper->GetJSObject(&realObj);
 
@@ -6420,21 +6418,20 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
       JSObject *proto = STOBJ_GET_PROTO(obj);
       if (proto) {
         jsid interned_id;
-        JSProperty *prop = nsnull;
+        JSObject *pobj = NULL;
+        jsval val;
 
         if (!::JS_ValueToId(cx, id, &interned_id) ||
-            !OBJ_LOOKUP_PROPERTY(cx, proto, interned_id, objp, &prop)) {
+            !::JS_LookupPropertyByIdWithFlags(cx, proto, interned_id, flags,
+                                              &pobj, &val)) {
           *_retval = JS_FALSE;
 
           return NS_OK;
         }
 
-        if (prop) {
+        if (pobj) {
-          // A property was found on the prototype chain, and *objp is
+          // A property was found on the prototype chain.
-          // already set to point to the prototype where the property
+          *objp = pobj;
-          // was found.
-          OBJ_DROP_PROPERTY(cx, proto, prop);
-
           return NS_OK;
         }
       }

js/src/jsapi.cpp

@@ -657,6 +657,8 @@ JS_TypeOfValue(JSContext *cx, jsval v)
                     type = JSTYPE_FUNCTION;
                 } else {
 #ifdef NARCISSUS
+                    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
+
                     if (!OBJ_GET_PROPERTY(cx, obj,
                                           ATOM_TO_JSID(cx->runtime->atomState
                                                        .callAtom),
@@ -2978,10 +2980,14 @@ JS_GetConstructor(JSContext *cx, JSObject *proto)
     jsval cval;
 
     CHECK_REQUEST(cx);
-    if (!OBJ_GET_PROPERTY(cx, proto,
+    {
-                          ATOM_TO_JSID(cx->runtime->atomState.constructorAtom),
+        JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
-                          &cval)) {
+
-        return NULL;
+        if (!OBJ_GET_PROPERTY(cx, proto,
+                              ATOM_TO_JSID(cx->runtime->atomState.constructorAtom),
+                              &cval)) {
+            return NULL;
+        }
     }
     if (!VALUE_IS_FUNCTION(cx, cval)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NO_CONSTRUCTOR,
@@ -3121,6 +3127,7 @@ DefineProperty(JSContext *cx, JSObject *obj, const char *name, jsval value,
         id = ATOM_TO_JSID(atom);
     }
     if (flags != 0 && OBJ_IS_NATIVE(obj)) {
+        JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_DECLARING);
         return js_DefineNativeProperty(cx, obj, id, value, getter, setter,
                                        attrs, flags, tinyid, NULL);
     }
@@ -3142,6 +3149,7 @@ DefineUCProperty(JSContext *cx, JSObject *obj,
     if (!atom)
         return JS_FALSE;
     if (flags != 0 && OBJ_IS_NATIVE(obj)) {
+        JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_DECLARING);
         return js_DefineNativeProperty(cx, obj, ATOM_TO_JSID(atom), value,
                                        getter, setter, attrs, flags, tinyid,
                                        NULL);
@@ -3175,17 +3183,17 @@ JS_DefineConstDoubles(JSContext *cx, JSObject *obj, JSConstDoubleSpec *cds)
 {
     JSBool ok;
     jsval value;
-    uintN flags;
+    uintN attrs;
 
     CHECK_REQUEST(cx);
     for (ok = JS_TRUE; cds->name; cds++) {
         ok = js_NewNumberInRootedValue(cx, cds->dval, &value);
         if (!ok)
             break;
-        flags = cds->flags;
+        attrs = cds->flags;
-        if (!flags)
+        if (!attrs)
-            flags = JSPROP_READONLY | JSPROP_PERMANENT;
+            attrs = JSPROP_READONLY | JSPROP_PERMANENT;
-        ok = DefineProperty(cx, obj, cds->name, value, NULL, NULL, flags, 0, 0);
+        ok = DefineProperty(cx, obj, cds->name, value, NULL, NULL, attrs, 0, 0);
         if (!ok)
             break;
     }
@@ -3228,20 +3236,28 @@ JS_DefinePropertyWithTinyId(JSContext *cx, JSObject *obj, const char *name,
 }
 
 static JSBool
-LookupProperty(JSContext *cx, JSObject *obj, const char *name, JSObject **objp,
+LookupPropertyById(JSContext *cx, JSObject *obj, jsid id, uintN flags,
-               JSProperty **propp)
+                   JSObject **objp, JSProperty **propp)
+{
+    JSAutoResolveFlags rf(cx, flags);
+    return OBJ_LOOKUP_PROPERTY(cx, obj, id, objp, propp);
+}
+
+static JSBool
+LookupProperty(JSContext *cx, JSObject *obj, const char *name, uintN flags,
+               JSObject **objp, JSProperty **propp)
 {
     JSAtom *atom;
 
     atom = js_Atomize(cx, name, strlen(name), 0);
     if (!atom)
         return JS_FALSE;
-    return OBJ_LOOKUP_PROPERTY(cx, obj, ATOM_TO_JSID(atom), objp, propp);
+    return LookupPropertyById(cx, obj, ATOM_TO_JSID(atom), flags, objp, propp);
 }
 
 static JSBool
 LookupUCProperty(JSContext *cx, JSObject *obj,
-                 const jschar *name, size_t namelen,
+                 const jschar *name, size_t namelen, uintN flags,
                  JSObject **objp, JSProperty **propp)
 {
     JSAtom *atom;
@@ -3249,7 +3265,7 @@ LookupUCProperty(JSContext *cx, JSObject *obj,
     atom = js_AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen), 0);
     if (!atom)
         return JS_FALSE;
-    return OBJ_LOOKUP_PROPERTY(cx, obj, ATOM_TO_JSID(atom), objp, propp);
+    return LookupPropertyById(cx, obj, ATOM_TO_JSID(atom), flags, objp, propp);
 }
 
 JS_PUBLIC_API(JSBool)
@@ -3263,7 +3279,7 @@ JS_AliasProperty(JSContext *cx, JSObject *obj, const char *name,
     JSScopeProperty *sprop;
 
     CHECK_REQUEST(cx);
-    if (!LookupProperty(cx, obj, name, &obj2, &prop))
+    if (!LookupProperty(cx, obj, name, JSRESOLVE_QUALIFIED, &obj2, &prop))
         return JS_FALSE;
     if (!prop) {
         js_ReportIsNotDefined(cx, name);
@@ -3325,8 +3341,10 @@ GetPropertyAttributes(JSContext *cx, JSObject *obj, JSAtom *atom,
 
     if (!atom)
         return JS_FALSE;
-    if (!OBJ_LOOKUP_PROPERTY(cx, obj, ATOM_TO_JSID(atom), &obj2, &prop))
+    if (!LookupPropertyById(cx, obj, ATOM_TO_JSID(atom), JSRESOLVE_QUALIFIED,
+                            &obj2, &prop)) {
         return JS_FALSE;
+    }
 
     if (!prop || obj != obj2) {
         *attrsp = 0;
@@ -3364,8 +3382,10 @@ SetPropertyAttributes(JSContext *cx, JSObject *obj, JSAtom *atom,
 
     if (!atom)
         return JS_FALSE;
-    if (!OBJ_LOOKUP_PROPERTY(cx, obj, ATOM_TO_JSID(atom), &obj2, &prop))
+    if (!LookupPropertyById(cx, obj, ATOM_TO_JSID(atom), JSRESOLVE_QUALIFIED,
+                            &obj2, &prop)) {
         return JS_FALSE;
+    }
     if (!prop || obj != obj2) {
         *foundp = JS_FALSE;
         if (prop)
@@ -3422,8 +3442,11 @@ AlreadyHasOwnPropertyHelper(JSContext *cx, JSObject *obj, jsid id,
         JSObject *obj2;
         JSProperty *prop;
 
-        if (!OBJ_LOOKUP_PROPERTY(cx, obj, id, &obj2, &prop))
+        if (!LookupPropertyById(cx, obj, id,
+                                JSRESOLVE_QUALIFIED | JSRESOLVE_DETECTING,
+                                &obj2, &prop)) {
             return JS_FALSE;
+        }
         *foundp = (obj == obj2);
         if (prop)
             OBJ_DROP_PROPERTY(cx, obj2, prop);
@@ -3458,7 +3481,9 @@ JS_HasProperty(JSContext *cx, JSObject *obj, const char *name, JSBool *foundp)
     JSProperty *prop;
 
     CHECK_REQUEST(cx);
-    ok = LookupProperty(cx, obj, name, &obj2, &prop);
+    ok = LookupProperty(cx, obj, name,
+                        JSRESOLVE_QUALIFIED | JSRESOLVE_DETECTING,
+                        &obj2, &prop);
     if (ok) {
         *foundp = (prop != NULL);
         if (prop)
@@ -3475,7 +3500,7 @@ JS_LookupProperty(JSContext *cx, JSObject *obj, const char *name, jsval *vp)
     JSProperty *prop;
 
     CHECK_REQUEST(cx);
-    ok = LookupProperty(cx, obj, name, &obj2, &prop);
+    ok = LookupProperty(cx, obj, name, JSRESOLVE_QUALIFIED, &obj2, &prop);
     if (ok)
         *vp = LookupResult(cx, obj, obj2, prop);
     return ok;
@@ -3486,20 +3511,27 @@ JS_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, const char *name,
                            uintN flags, jsval *vp)
 {
     JSAtom *atom;
-    JSBool ok;
     JSObject *obj2;
+
+    atom = js_Atomize(cx, name, strlen(name), 0);
+    return atom &&
+           JS_LookupPropertyByIdWithFlags(cx, obj, ATOM_TO_JSID(atom), flags,
+                                          &obj2, vp);
+}
+
+JS_PUBLIC_API(JSBool)
+JS_LookupPropertyByIdWithFlags(JSContext *cx, JSObject *obj, jsid id,
+                               uintN flags, JSObject **objp, jsval *vp)
+{
+    JSBool ok;
     JSProperty *prop;
 
     CHECK_REQUEST(cx);
-    atom = js_Atomize(cx, name, strlen(name), 0);
-    if (!atom)
-        return JS_FALSE;
     ok = OBJ_IS_NATIVE(obj)
-         ? js_LookupPropertyWithFlags(cx, obj, ATOM_TO_JSID(atom), flags,
+         ? js_LookupPropertyWithFlags(cx, obj, id, flags, objp, &prop) >= 0
-                                      &obj2, &prop) >= 0
+         : OBJ_LOOKUP_PROPERTY(cx, obj, id, objp, &prop);
-         : OBJ_LOOKUP_PROPERTY(cx, obj, ATOM_TO_JSID(atom), &obj2, &prop);
     if (ok)
-        *vp = LookupResult(cx, obj, obj2, prop);
+        *vp = LookupResult(cx, obj, *objp, prop);
     return ok;
 }
 
@@ -3512,6 +3544,8 @@ JS_GetProperty(JSContext *cx, JSObject *obj, const char *name, jsval *vp)
     atom = js_Atomize(cx, name, strlen(name), 0);
     if (!atom)
         return JS_FALSE;
+
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
     return OBJ_GET_PROPERTY(cx, obj, ATOM_TO_JSID(atom), vp);
 }
 
@@ -3519,8 +3553,9 @@ JS_PUBLIC_API(JSBool)
 JS_GetMethodById(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
                  jsval *vp)
 {
-    CHECK_REQUEST(cx);
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
 
+    CHECK_REQUEST(cx);
 #if JS_HAS_XML_SUPPORT
     if (OBJECT_IS_XML(cx, obj)) {
         JSXMLObjectOps *ops;
@@ -3561,6 +3596,8 @@ JS_SetProperty(JSContext *cx, JSObject *obj, const char *name, jsval *vp)
     atom = js_Atomize(cx, name, strlen(name), 0);
     if (!atom)
         return JS_FALSE;
+
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_ASSIGNING);
     return OBJ_SET_PROPERTY(cx, obj, ATOM_TO_JSID(atom), vp);
 }
 
@@ -3583,6 +3620,8 @@ JS_DeleteProperty2(JSContext *cx, JSObject *obj, const char *name,
     atom = js_Atomize(cx, name, strlen(name), 0);
     if (!atom)
         return JS_FALSE;
+
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
     return OBJ_DELETE_PROPERTY(cx, obj, ATOM_TO_JSID(atom), rval);
 }
 
@@ -3668,7 +3707,9 @@ JS_HasUCProperty(JSContext *cx, JSObject *obj,
     JSProperty *prop;
 
     CHECK_REQUEST(cx);
-    ok = LookupUCProperty(cx, obj, name, namelen, &obj2, &prop);
+    ok = LookupUCProperty(cx, obj, name, namelen, 
+                          JSRESOLVE_QUALIFIED | JSRESOLVE_DETECTING,
+                          &obj2, &prop);
     if (ok) {
         *vp = (prop != NULL);
         if (prop)
@@ -3687,7 +3728,8 @@ JS_LookupUCProperty(JSContext *cx, JSObject *obj,
     JSProperty *prop;
 
     CHECK_REQUEST(cx);
-    ok = LookupUCProperty(cx, obj, name, namelen, &obj2, &prop);
+    ok = LookupUCProperty(cx, obj, name, namelen, JSRESOLVE_QUALIFIED,
+                          &obj2, &prop);
     if (ok)
         *vp = LookupResult(cx, obj, obj2, prop);
     return ok;
@@ -3704,6 +3746,8 @@ JS_GetUCProperty(JSContext *cx, JSObject *obj,
     atom = js_AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen), 0);
     if (!atom)
         return JS_FALSE;
+
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
     return OBJ_GET_PROPERTY(cx, obj, ATOM_TO_JSID(atom), vp);
 }
 
@@ -3718,6 +3762,8 @@ JS_SetUCProperty(JSContext *cx, JSObject *obj,
     atom = js_AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen), 0);
     if (!atom)
         return JS_FALSE;
+
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_ASSIGNING);
     return OBJ_SET_PROPERTY(cx, obj, ATOM_TO_JSID(atom), vp);
 }
 
@@ -3732,6 +3778,8 @@ JS_DeleteUCProperty2(JSContext *cx, JSObject *obj,
     atom = js_AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen), 0);
     if (!atom)
         return JS_FALSE;
+
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
     return OBJ_DELETE_PROPERTY(cx, obj, ATOM_TO_JSID(atom), rval);
 }
 
@@ -3774,6 +3822,8 @@ JS_PUBLIC_API(JSBool)
 JS_DefineElement(JSContext *cx, JSObject *obj, jsint index, jsval value,
                  JSPropertyOp getter, JSPropertyOp setter, uintN attrs)
 {
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_DECLARING);
+
     CHECK_REQUEST(cx);
     return OBJ_DEFINE_PROPERTY(cx, obj, INT_TO_JSID(index), value,
                                getter, setter, attrs, NULL);
@@ -3788,7 +3838,7 @@ JS_AliasElement(JSContext *cx, JSObject *obj, const char *name, jsint alias)
     JSBool ok;
 
     CHECK_REQUEST(cx);
-    if (!LookupProperty(cx, obj, name, &obj2, &prop))
+    if (!LookupProperty(cx, obj, name, JSRESOLVE_QUALIFIED, &obj2, &prop))
         return JS_FALSE;
     if (!prop) {
         js_ReportIsNotDefined(cx, name);
@@ -3827,7 +3877,9 @@ JS_HasElement(JSContext *cx, JSObject *obj, jsint index, JSBool *foundp)
     JSProperty *prop;
 
     CHECK_REQUEST(cx);
-    ok = OBJ_LOOKUP_PROPERTY(cx, obj, INT_TO_JSID(index), &obj2, &prop);
+    ok = LookupPropertyById(cx, obj, INT_TO_JSID(index),
+                            JSRESOLVE_QUALIFIED | JSRESOLVE_DETECTING,
+                            &obj2, &prop);
     if (ok) {
         *foundp = (prop != NULL);
         if (prop)
@@ -3844,7 +3896,8 @@ JS_LookupElement(JSContext *cx, JSObject *obj, jsint index, jsval *vp)
     JSProperty *prop;
 
     CHECK_REQUEST(cx);
-    ok = OBJ_LOOKUP_PROPERTY(cx, obj, INT_TO_JSID(index), &obj2, &prop);
+    ok = LookupPropertyById(cx, obj, INT_TO_JSID(index), JSRESOLVE_QUALIFIED,
+                            &obj2, &prop);
     if (ok)
         *vp = LookupResult(cx, obj, obj2, prop);
     return ok;
@@ -3853,6 +3906,8 @@ JS_LookupElement(JSContext *cx, JSObject *obj, jsint index, jsval *vp)
 JS_PUBLIC_API(JSBool)
 JS_GetElement(JSContext *cx, JSObject *obj, jsint index, jsval *vp)
 {
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
+
     CHECK_REQUEST(cx);
     return OBJ_GET_PROPERTY(cx, obj, INT_TO_JSID(index), vp);
 }
@@ -3860,6 +3915,8 @@ JS_GetElement(JSContext *cx, JSObject *obj, jsint index, jsval *vp)
 JS_PUBLIC_API(JSBool)
 JS_SetElement(JSContext *cx, JSObject *obj, jsint index, jsval *vp)
 {
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_ASSIGNING);
+
     CHECK_REQUEST(cx);
     return OBJ_SET_PROPERTY(cx, obj, INT_TO_JSID(index), vp);
 }
@@ -3869,13 +3926,14 @@ JS_DeleteElement(JSContext *cx, JSObject *obj, jsint index)
 {
     jsval junk;
 
-    CHECK_REQUEST(cx);
     return JS_DeleteElement2(cx, obj, index, &junk);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_DeleteElement2(JSContext *cx, JSObject *obj, jsint index, jsval *rval)
 {
+    JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
+
     CHECK_REQUEST(cx);
     return OBJ_DELETE_PROPERTY(cx, obj, INT_TO_JSID(index), rval);
 }

js/src/jsapi.h

@@ -1626,6 +1626,10 @@ extern JS_PUBLIC_API(JSBool)
 JS_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, const char *name,
                            uintN flags, jsval *vp);
 
+extern JS_PUBLIC_API(JSBool)
+JS_LookupPropertyByIdWithFlags(JSContext *cx, JSObject *obj, jsid id,
+                               uintN flags, JSObject **objp, jsval *vp);
+
 extern JS_PUBLIC_API(JSBool)
 JS_GetProperty(JSContext *cx, JSObject *obj, const char *name, jsval *vp);
 

js/src/jsarray.cpp

@@ -707,7 +707,8 @@ array_getProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
         }
 
         *vp = JSVAL_VOID;
-        if (js_LookupPropertyWithFlags(cx, proto, id, 0, &obj2, &prop) < 0)
+        if (js_LookupPropertyWithFlags(cx, proto, id, cx->resolveFlags,
+                                       &obj2, &prop) < 0)
             return JS_FALSE;
 
         if (prop) {

js/src/jscntxt.cpp

@@ -301,6 +301,8 @@ js_NewContext(JSRuntime *rt, size_t stackChunkSize)
         return NULL;
     }
 
+    cx->resolveFlags = 0;
+
     /*
      * If cx is the first context on this runtime, initialize well-known atoms,
      * keywords, numbers, and strings.  If one of these steps should fail, the

js/src/jscntxt.h

@@ -722,6 +722,9 @@ JS_STATIC_ASSERT(sizeof(JSTempValueUnion) == sizeof(void *));
 #define JS_PUSH_TEMP_ROOT_SCRIPT(cx,script_,tvr)                              \
     JS_PUSH_TEMP_ROOT_COMMON(cx, script_, tvr, JSTVU_SCRIPT, script)
 
+
+#define JSRESOLVE_INFER         0xffff  /* infer bits from current bytecode */
+
 struct JSContext {
     /* JSRuntime contextList linkage. */
     JSCList             links;
@@ -889,6 +892,9 @@ struct JSContext {
 
     /* Pinned regexp pool used for regular expressions. */
     JSArenaPool         regexpPool;
+
+    /* Stored here to avoid passing it around as a parameter. */
+    uintN               resolveFlags;
 };
 
 #ifdef JS_THREADSAFE
@@ -922,6 +928,21 @@ class JSAutoTempValueRooter
     JSContext *mContext;
     JSTempValueRooter mTvr;
 };
+
+class JSAutoResolveFlags
+{
+  public:
+    JSAutoResolveFlags(JSContext *cx, uintN flags)
+        : mContext(cx), mSaved(cx->resolveFlags) {
+        cx->resolveFlags = flags;
+    }
+
+    ~JSAutoResolveFlags() { mContext->resolveFlags = mSaved; }
+
+  private:
+    JSContext *mContext;
+    uintN mSaved;
+};
 #endif
 
 /*

js/src/jsinterp.cpp

@@ -2472,6 +2472,7 @@ js_Interpret(JSContext *cx)
 #if JS_HAS_GETTER_SETTER
     JSPropertyOp getter, setter;
 #endif
+    JSAutoResolveFlags rf(cx, JSRESOLVE_INFER);
 
 #ifdef __GNUC__
 # define JS_EXTENSION __extension__

js/src/jsobj.cpp

@@ -3293,7 +3293,8 @@ JS_FRIEND_API(JSBool)
 js_LookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
                   JSProperty **propp)
 {
-    return js_LookupPropertyWithFlags(cx, obj, id, 0, objp, propp) >= 0;
+    return js_LookupPropertyWithFlags(cx, obj, id, cx->resolveFlags,
+                                      objp, propp) >= 0;
 }
 
 #define SCOPE_DEPTH_ACCUM(bs,val)                                             \
@@ -3365,8 +3366,8 @@ js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
 
                 if (clasp->flags & JSCLASS_NEW_RESOLVE) {
                     newresolve = (JSNewResolveOp)resolve;
-                    if (!(flags & JSRESOLVE_CLASSNAME) &&
+                    if (flags == JSRESOLVE_INFER && cx->fp && cx->fp->regs) {
-                        cx->fp && cx->fp->regs) {
+                        flags = 0;
                         pc = cx->fp->regs->pc;
                         cs = &js_CodeSpec[*pc];
                         format = cs->format;
@@ -3505,7 +3506,8 @@ js_FindPropertyHelper(JSContext *cx, jsid id, JSObject **objp,
     for (scopeIndex = 0; ; scopeIndex++) {
         if (obj->map->ops->lookupProperty == js_LookupProperty) {
             protoIndex =
-                js_LookupPropertyWithFlags(cx, obj, id, 0, &pobj, &prop);
+                js_LookupPropertyWithFlags(cx, obj, id, cx->resolveFlags,
+                                           &pobj, &prop);
         } else {
             if (!OBJ_LOOKUP_PROPERTY(cx, obj, id, &pobj, &prop))
                 return -1;
@@ -3702,7 +3704,8 @@ js_GetPropertyHelper(JSContext *cx, JSObject *obj, jsid id, jsval *vp,
     JS_COUNT_OPERATION(cx, JSOW_GET_PROPERTY);
 
     shape = OBJ_SHAPE(obj);
-    protoIndex = js_LookupPropertyWithFlags(cx, obj, id, 0, &obj2, &prop);
+    protoIndex = js_LookupPropertyWithFlags(cx, obj, id, cx->resolveFlags,
+                                            &obj2, &prop);
     if (protoIndex < 0)
         return JS_FALSE;
     if (!prop) {
@@ -3803,7 +3806,8 @@ js_SetPropertyHelper(JSContext *cx, JSObject *obj, jsid id, jsval *vp,
     JS_COUNT_OPERATION(cx, JSOW_SET_PROPERTY);
 
     shape = OBJ_SHAPE(obj);
-    protoIndex = js_LookupPropertyWithFlags(cx, obj, id, 0, &pobj, &prop);
+    protoIndex = js_LookupPropertyWithFlags(cx, obj, id, cx->resolveFlags,
+                                            &pobj, &prop);
     if (protoIndex < 0)
         return JS_FALSE;
 

js/src/jstracer.cpp

@@ -3481,7 +3481,9 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
             if (js_FindPropertyHelper(cx, id, &obj, &obj2, &prop, &entry) < 0)
                 ABORT_TRACE("failed to find name");
         } else {
-            int protoIndex = js_LookupPropertyWithFlags(cx, aobj, id, 0, &obj2, &prop);
+            int protoIndex = js_LookupPropertyWithFlags(cx, aobj, id,
+                                                        cx->resolveFlags,
+                                                        &obj2, &prop);
             if (protoIndex < 0)
                 ABORT_TRACE("failed to lookup property");