From d7c0ae169d63c93cd1183909dda32b9d3d4f5609 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Mon, 25 Aug 2014 10:08:24 +0200
Subject: [PATCH] Bug 1055864 - IonMonkey: Remove bogus assert in
 MTruncateToInt32, r=jandem

---
 js/src/jit-test/tests/ion/bug1055864.js | 8 ++++++++
 js/src/jit/MIR.h                        | 1 -
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1055864.js

diff --git a/js/src/jit-test/tests/ion/bug1055864.js b/js/src/jit-test/tests/ion/bug1055864.js
new file mode 100644
index 000000000000..0cf993cb43d5
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1055864.js
@@ -0,0 +1,8 @@
+function f() {}
+(function() {
+    f()
+})()
+function g() {
+    new f >> 0
+}
+g()
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 66f3feea58cd..fdf078252445 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3918,7 +3918,6 @@ class MTruncateToInt32
 
         // An object might have "valueOf", which means it is effectful.
         // ToInt32(symbol) throws.
-        MOZ_ASSERT(def->type() != MIRType_Object);
         if (def->mightBeType(MIRType_Object) || def->mightBeType(MIRType_Symbol))
             setGuard();
     }