Bug 995673 - IonMonkey: Don't remove MToXXX instructions, when an object flows through, r=jandem

js/src/jit-test/tests/ion/bug995673.js

@@ -0,0 +1,16 @@
+var total = 0
+
+x = [ [] ]
+x[0].valueOf = function () {
+  total++;
+}
+function f(y) {
+    y != Math.abs()
+}
+(function() {
+    f()
+    f(x[0])
+    f(x[0])
+})()
+
+assertEq(total, 2)

js/src/jit/MIR.h

@@ -2823,6 +2823,10 @@ class MToDouble
     {
         setResultType(MIRType_Double);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public:
@@ -2885,6 +2889,10 @@ class MToFloat32
     {
         setResultType(MIRType_Float32);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public:
@@ -2993,6 +3001,10 @@ class MToInt32
     {
         setResultType(MIRType_Int32);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public:
@@ -3047,6 +3059,10 @@ class MTruncateToInt32 : public MUnaryInstruction
     {
         setResultType(MIRType_Int32);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public: