[JAEGER] Fixed incorrect use of syncExit() in relational compare (bug 585391).

js/src/methodjit/FastArithmetic.cpp

@@ -1404,7 +1404,7 @@ mjit::Compiler::jsop_relational_full(JSOp op, BoolStub stub, jsbytecode *target,
                 rhsNotNumber2.get().linkTo(stubcc.masm.label(), &stubcc.masm);
 
             /* Emit the slow path - note full frame syncage. */
-            stubcc.syncExit(Uses(2));
+            frame.sync(stubcc.masm, Uses(2));
             stubcc.leave();
             stubcc.call(stub);
         }

js/src/methodjit/FastOps.cpp

@@ -337,8 +337,7 @@ mjit::Compiler::jsop_bitop(JSOp op)
     }
 
     /* We only want to handle integers here. */
-    if ((rhs->isTypeKnown() && rhs->getKnownType() != JSVAL_TYPE_INT32) ||
-        (lhs->isTypeKnown() && lhs->getKnownType() != JSVAL_TYPE_INT32)) {
+    if (rhs->isNotType(JSVAL_TYPE_INT32) || lhs->isNotType(JSVAL_TYPE_INT32)) {
         prepareStubCall(Uses(2));
         stubCall(stub);
         frame.popn(2);

js/src/trace-test/tests/jaeger/bug585391.js

@@ -0,0 +1,11 @@
+var x = (function () {
+    return [, , ]
+}());
+(function () {
+    while (x > 7 & 0) {
+        return
+    }
+}())
+
+/* Don't assert. */
+