Created attachment 557602 [details]
testcase (asserts fatally when loaded)
Assertion failure: hasSingletonType(), at js/src/jsinfer.cpp:5071
Created attachment 557604 [details]
Created attachment 558530 [details] [diff] [review]
TI adds a JS_SplicePrototype API function which allows XPConnect to rearrange the prototype chain while preserving precise types for global properties etc. This is only intended to be used for objects with singleton types (where we can do this rearranging), but because of mutable __proto__ other objects may get passed in instead. Fix makes this function robust for such objects.
Filter on qa-project-auto-change:
Bug in removed tracer code, setting in-testsuite- flag.