Bug 860531 - Change AliasSet of MCallGetIntrinsicValue to None. (r=dvander)

js/src/ion/IonBuilder.cpp

@@ -5737,7 +5737,6 @@ IonBuilder::jsop_intrinsic(HandlePropertyName name)
 
         RootedScript scriptRoot(cx, script());
         types::StackTypeSet *barrier = oracle->propertyReadBarrier(scriptRoot, pc);
-        monitorResult(ins, barrier, types);
         return pushTypeBarrier(ins, types, barrier);
     }
 

js/src/ion/MIR.h

@@ -5908,6 +5908,9 @@ class MCallGetIntrinsicValue : public MNullaryInstruction
     PropertyName *name() const {
         return name_;
     }
+    AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
 };
 
 class MCallsiteCloneCache

js/src/ion/VMFunctions.cpp

@@ -517,7 +517,17 @@ OperatorInI(JSContext *cx, uint32_t index, HandleObject obj, JSBool *out)
 bool
 GetIntrinsicValue(JSContext *cx, HandlePropertyName name, MutableHandleValue rval)
 {
-    return cx->global()->getIntrinsicValue(cx, name, rval);
+    if (!cx->global()->getIntrinsicValue(cx, name, rval))
+        return false;
+
+    // This function is called when we try to compile a cold getintrinsic
+    // op. MCallGetIntrinsicValue has an AliasSet of None for optimization
+    // purposes, as its side effect is not observable from JS. We are
+    // guaranteed to bail out after this function, but because of its AliasSet,
+    // type info will not be reflowed. Manually monitor here.
+    types::TypeScript::Monitor(cx, rval);
+
+    return true;
 }
 
 bool