Bug 1204675: IonMonkey - Don't specialize using baseline stubs for strict equality, r=jandem

js/src/jit-test/tests/ion/bug1204675.js

@@ -0,0 +1,13 @@
+function f(m, x) {
+        for (var i = 0; i < 2; ++i) {
+                    print(m(x[0]));
+                        }
+}
+function g() {
+        return false;
+}
+function h(y) {
+        return (y === 0);
+}
+f(g, [objectEmulatingUndefined()]);
+f(h, [false]);

js/src/jit/IonBuilder.cpp

@@ -6874,6 +6874,10 @@ IonBuilder::compareTrySpecializedOnBaselineInspector(bool* emitted, JSOp op, MDe
     // for the opcode. These will cause the instruction's type policy to insert
     // fallible unboxes to the appropriate input types.
 
+    // Strict equality isn't supported.
+    if (op == JSOP_STRICTEQ || op == JSOP_STRICTNE)
+        return true;
+
     MCompare::CompareType type = inspector->expectedCompareType(pc);
     if (type == MCompare::Compare_Unknown)
         return true;