Bug 1148375 - Ignore unhandled Elements. r=jandem

js/src/jit/MIR.cpp

@@ -4191,6 +4191,10 @@ MaybeUnwrapElements(const MDefinition* elementsOrObj)
     if (elementsOrObj->type() == MIRType_Object)
         return nullptr;
 
+    // MTypedArrayElements and MTypedObjectElements aren't handled.
+    if (!elementsOrObj->isElements())
+        return nullptr;
+
     return elementsOrObj->toElements();
 }
 
@@ -4201,12 +4205,14 @@ GetStoreObject(const MDefinition* store)
     switch (store->op()) {
       case MDefinition::Op_StoreElement: {
         const MDefinition* elementsOrObj = store->toStoreElement()->elements();
+        if (elementsOrObj->type() == MIRType_Object)
+            return elementsOrObj;
+
         const MDefinition* elements = MaybeUnwrapElements(elementsOrObj);
         if (elements)
             return elements->toElements()->input();
 
-        MOZ_ASSERT(elementsOrObj->type() == MIRType_Object);
-        return elementsOrObj;
+        return nullptr;
       }
 
       case MDefinition::Op_StoreElementHole:
@@ -4225,7 +4231,11 @@ GenericLoadMightAlias(const MDefinition* elementsOrObj, const MDefinition* store
     if (elements)
         return elements->mightAlias(store);
 
-    // If MElements couldn't be extracted, then storage must be inline.
+    // Unhandled Elements kind.
+    if (elementsOrObj->type() != MIRType_Object)
+        return true;
+
+    // Inline storage for objects.
     // Refer to IsValidElementsType().
     const MDefinition* object = elementsOrObj;
     MOZ_ASSERT(object->type() == MIRType_Object);