From 3def9c33a778162b32fbde3a8e699e2d0017e399 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Tue, 22 Sep 2015 20:11:31 +0200
Subject: [PATCH] Bug 1207210 - Fix MTypeBarrier::alwaysBails to handle
 ObjectOrNull inputs correctly. r=h4writer

---
 js/src/jit/MIR.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index f6b4da0e7ebd..f73ecda36618 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -12427,6 +12427,12 @@ class MTypeBarrier
             return false;
         if (input()->type() == MIRType_Value)
             return false;
+        if (input()->type() == MIRType_ObjectOrNull) {
+            // The ObjectOrNull optimization is only performed when the
+            // barrier's type is MIRType_Null.
+            MOZ_ASSERT(type == MIRType_Null);
+            return false;
+        }
         return input()->type() != type;
     }