Fix construction of simple objects with setters on prototype...

src/runtime.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4831 matching lines @@
 
   PretenureFlag pretenure = (context->global_context() == *context)
       ? TENURED       // Allocate global closures in old space.
       : NOT_TENURED;  // Allocate local closures in new space.
   Handle<JSFunction> result =
       Factory::NewFunctionFromBoilerplate(boilerplate, context, pretenure);
   return *result;
 }
 
 
-static Code* ComputeConstructStub(Handle<SharedFunctionInfo> shared) {
+static Code* ComputeConstructStub(Handle<JSFunction> function) {
   if (FLAG_inline_new
-      && shared->has_only_simple_this_property_assignments()) {
+      && function->shared()->has_only_simple_this_property_assignments()
+      && (!function->has_instance_prototype()
+          || !JSObject::cast(function->instance_prototype())->HasSetter())) {
     ConstructStubCompiler compiler;
-    Object* code = compiler.CompileConstructStub(*shared);
+    Object* code = compiler.CompileConstructStub(function->shared());
     if (code->IsFailure()) {
       return Builtins::builtin(Builtins::JSConstructStubGeneric);
     }
     return Code::cast(code);
   }
 
-  return shared->construct_stub();
+  return function->shared()->construct_stub();
 }
 
 
 static Object* Runtime_NewObject(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   Handle<Object> constructor = args.at<Object>(0);
 
   // If the constructor isn't a proper function we throw a type error.
@@ skipping 29 matching lines @@
     }
   }
 
   // The function should be compiled for the optimization hints to be available.
   Handle<SharedFunctionInfo> shared(function->shared());
   EnsureCompiled(shared, CLEAR_EXCEPTION);
 
   bool first_allocation = !function->has_initial_map();
   Handle<JSObject> result = Factory::NewJSObject(function);
   if (first_allocation) {
-    Handle<Map> map = Handle<Map>(function->initial_map());
     Handle<Code> stub = Handle<Code>(
-        ComputeConstructStub(Handle<SharedFunctionInfo>(function->shared())));
-    function->shared()->set_construct_stub(*stub);
+        ComputeConstructStub(Handle<JSFunction>(function)));
+    shared->set_construct_stub(*stub);
   }
 
   Counters::constructed_objects.Increment();
   Counters::constructed_objects_runtime.Increment();
 
   return *result;
 }
 
 
 static Object* Runtime_LazyCompile(Arguments args) {
@@ skipping 3311 matching lines @@
   } else {
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     Counters::gc_last_resort_from_js.Increment();
     Heap::CollectAllGarbage(false);
   }
 }
 
 
 } }  // namespace v8::internal