Bug 1004388 part 1. When we're testing an MPhi that doesn't represent the and-or pattern, just fall back to optimizing the typeset for the true/false branches based on the truthiness directly, like we would for the non-MPhi case. r=jandem

js/src/jit/IonBuilder.cpp

@@ -3367,6 +3367,11 @@ IonBuilder::improveTypesAtTest(MDefinition *ins, bool trueBranch, MTest *test)
     if (!ins)
         return true;
 
+    // All branches of this switch that don't want to fall through to the
+    // default behavior must return.  The default behavior assumes that a true
+    // test means the incoming ins is not null or undefined and that a false
+    // tests means it's one of null, undefined, false, 0, "", and objects
+    // emulating undefined
     switch (ins->op()) {
       case MDefinition::Op_Not:
         return improveTypesAtTest(ins->toNot()->getOperand(0), !trueBranch, test);
@@ -3390,8 +3395,10 @@ IonBuilder::improveTypesAtTest(MDefinition *ins, bool trueBranch, MTest *test)
       }
       case MDefinition::Op_Phi: {
         bool branchIsAnd = true;
-        if (!detectAndOrStructure(ins->toPhi(), &branchIsAnd))
-            return true;
+        if (!detectAndOrStructure(ins->toPhi(), &branchIsAnd)) {
+            // Just fall through to the default behavior.
+            break;
+        }
 
         // Now we have detected the triangular structure and determined if it was an AND or an OR.
         if (branchIsAnd) {
@@ -3430,10 +3437,14 @@ IonBuilder::improveTypesAtTest(MDefinition *ins, bool trueBranch, MTest *test)
       case MDefinition::Op_Compare:
         return improveTypesAtCompare(ins->toCompare(), trueBranch, test);
 
+      default:
+        break;
+    }
+
     // By default MTest tests ToBoolean(input). As a result in the true branch we can filter
     // undefined and null. In false branch we can only encounter undefined, null, false, 0, ""
     // and objects that emulate undefined.
-      default: {
+
     // If ins does not have a typeset we return as we cannot optimize.
     if (!ins->resultTypeSet() || ins->resultTypeSet()->unknown())
         return true;
@@ -3472,11 +3483,8 @@ IonBuilder::improveTypesAtTest(MDefinition *ins, bool trueBranch, MTest *test)
         types::TemporaryTypeSet base(flags, static_cast<types::TypeObjectKey**>(nullptr));
         type = types::TypeSet::intersectSets(&base, oldType, alloc_->lifoAlloc());
     }
-        replaceTypeSet(ins, type, test);
-      }
 
-    }
-    return true;
+    return replaceTypeSet(ins, type, test);
 }
 
 bool