Bug 1384737 - Retain result type information for getprop caches that only produce null/undefined values, r=jandem.

js/src/jit-test/tests/ion/bug1384737.js

@@ -0,0 +1,8 @@
+function f(x) {
+    var count = 0;
+    for (var i = 0; i < x.length; ++i)
+	count++;
+    return count;
+}
+assertEq(f(Error()), 0);
+assertEq(f([[]]), 1);

js/src/jit/IonBuilder.cpp

@@ -11367,8 +11367,13 @@ IonBuilder::getPropAddCache(MDefinition* obj, PropertyName* name,
         MOZ_TRY(resumeAfter(load));
 
     MIRType rvalType = types->getKnownMIRType();
-    if (barrier != BarrierKind::NoBarrier || IsNullOrUndefined(rvalType))
+    if (barrier != BarrierKind::NoBarrier) {
         rvalType = MIRType::Value;
+    } else {
+        load->setResultTypeSet(types);
+        if (IsNullOrUndefined(rvalType))
+            rvalType = MIRType::Value;
+    }
     load->setResultType(rvalType);
 
     if (*pc != JSOP_CALLPROP || !IsNullOrUndefined(obj->type())) {