new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1079850.js
@@ -0,0 +1,5 @@
+function foo() {
+    for(__key in null)
+        var key=startTest(VERSION) ? this : this;
+    if (key !== undefined) {}
+} foo();

--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -861,20 +861,26 @@ FilterTypeSetPolicy::adjustInputs(TempAl
 
     // Output is a value, box the input.
     if (outputType == MIRType_Value) {
         MOZ_ASSERT(inputType != MIRType_Value);
         ins->replaceOperand(0, boxAt(alloc, ins, ins->getOperand(0)));
         return true;
     }
 
-    // The outputType should always be a subset of the inputType.
-    // So if types don't equal, the input type is definitely a MIRType_Value.
-    if (inputType != MIRType_Value)
-        MOZ_CRASH("Types should be in accordance.");
+    // The outputType should be a subset of the inputType else we are in code
+    // that has never executed yet. Bail to see the new type (if that hasn't
+    // happened yet).
+    if (inputType != MIRType_Value) {
+        MBail *bail = MBail::New(alloc);
+        ins->block()->insertBefore(ins, bail);
+        bail->setDependency(ins->dependency());
+        ins->setDependency(bail);
+        ins->replaceOperand(0, boxAt(alloc, ins, ins->getOperand(0)));
+    }
 
     // We can't unbox a value to null/undefined/lazyargs. So keep output
     // also a value.
     // Note: Using setResultType shouldn't be done in TypePolicies,
     //       Here it is fine, since the type barrier has no uses.
     if (IsNullOrUndefined(outputType) || outputType == MIRType_MagicOptimizedArguments) {
         MOZ_ASSERT(!ins->hasDefUses());
         ins->setResultType(MIRType_Value);