Bug 1207210 - Fix MTypeBarrier::alwaysBails to handle ObjectOrNull inputs correctly. r=h4writer

js/src/jit/MIR.h

@@ -12427,6 +12427,12 @@ class MTypeBarrier
             return false;
         if (input()->type() == MIRType_Value)
             return false;
+        if (input()->type() == MIRType_ObjectOrNull) {
+            // The ObjectOrNull optimization is only performed when the
+            // barrier's type is MIRType_Null.
+            MOZ_ASSERT(type == MIRType_Null);
+            return false;
+        }
         return input()->type() != type;
     }