Bug 858617: IonMonkey: When inlining box unknown inputs, r=nbp

js/src/ion/IonBuilder.cpp

@@ -3102,6 +3102,15 @@ IonBuilder::addTypeBarrier(uint32_t i, CallInfo &callinfo, types::StackTypeSet *
     if (needsBarrier) {
         MTypeBarrier *barrier = MTypeBarrier::New(ins, cloneTypeSet(calleeObs), Bailout_Normal);
         current->add(barrier);
+
+        // Make sure unknown inputs are always boxed.
+        if (callerObs->getKnownTypeTag() == JSVAL_TYPE_UNKNOWN &&
+            ins->type() != MIRType_Value)
+        {
+            MBox *box = MBox::New(ins);
+            current->add(box);
+            ins = box;
+        }
     }
 
     if (i == 0)

js/src/jsinfer.cpp

@@ -378,7 +378,7 @@ TypeSet::intersectionEmpty(TypeSet *other)
     if (unknown() || other->unknown())
         return false;
 
-    if (unknownObject() && unknownObject())
+    if (unknownObject() && other->unknownObject())
         return false;
 
     if (unknownObject() && other->getObjectCount() > 0)