From be6670e3a6a88777b0251637564151bd00aa3448 Mon Sep 17 00:00:00 2001
From: David Anderson <danderson@mozilla.com>
Date: Wed, 6 Oct 2010 11:06:18 -0700
Subject: [PATCH] Fix assert in InvokeConstructor (bug 602088, r=luke).

---
 js/src/jsinterp.cpp                        | 2 +-
 js/src/trace-test/tests/basic/bug602088.js | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 js/src/trace-test/tests/basic/bug602088.js

diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 2b53764f854..d6cd973398c 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -762,7 +762,7 @@ Invoke(JSContext *cx, const CallArgs &argsRef, uint32 flags)
     PutActivationObjects(cx, fp);
 
     args.rval() = fp->returnValue();
-    JS_ASSERT_IF(flags & JSINVOKE_CONSTRUCT, !args.rval().isPrimitive());
+    JS_ASSERT_IF(ok && (flags & JSINVOKE_CONSTRUCT), !args.rval().isPrimitive());
 
     return ok;
 }
diff --git a/js/src/trace-test/tests/basic/bug602088.js b/js/src/trace-test/tests/basic/bug602088.js
new file mode 100644
index 00000000000..f868dd9b53c
--- /dev/null
+++ b/js/src/trace-test/tests/basic/bug602088.js
@@ -0,0 +1,6 @@
+// |trace-test| error: TypeError
+/* vim: set ts=4 sw=4 tw=99 et: */
+
+var p = Proxy.createFunction({}, function(x, y) { undefined.x(); });
+print(new p(1, 2));
+