Bug 878627 - Give an empty result type set to binops with an empty lhs or rhs type set, r=djvj.

js/src/ion/MIR.cpp

@@ -315,6 +315,12 @@ MDefinition::replaceAllUsesWith(MDefinition *dom)
     }
 }
 
+bool
+MDefinition::emptyResultTypeSet() const
+{
+    return resultTypeSet() && resultTypeSet()->empty();
+}
+
 static inline bool
 IsPowerOfTwo(uint32_t n)
 {
@@ -1338,6 +1344,16 @@ MBinaryArithInstruction::inferFallback(BaselineInspector *inspector,
         setResultType(MIRType_Double);
         return;
     }
+
+    // If we can't specialize because we have no type information at all for
+    // the lhs or rhs, mark the binary instruction as having no possible types
+    // either to avoid degrading subsequent analysis.
+    if (getOperand(0)->emptyResultTypeSet() || getOperand(1)->emptyResultTypeSet()) {
+        LifoAlloc *alloc = GetIonContext()->temp->lifoAlloc();
+        types::StackTypeSet *types = alloc->new_<types::StackTypeSet>();
+        if (types)
+            setResultTypeSet(types);
+    }
 }
 
 static bool

js/src/ion/MIR.h

@@ -404,6 +404,7 @@ class MDefinition : public MNode
     types::StackTypeSet *resultTypeSet() const {
         return resultTypeSet_;
     }
+    bool emptyResultTypeSet() const;
 
     bool mightBeType(MIRType type) const {
         JS_ASSERT(type != MIRType_Value);