Bug 1151401 - Watch for non-object unboxes while optimizing object-or-null operations, r=jandem.
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -2556,17 +2556,18 @@ TryOptimizeLoadObjectOrNull(MDefinition*
break;
case MDefinition::Op_StoreSlot:
break;
case MDefinition::Op_ToObjectOrNull:
if (!eliminateList.append(ndef->toToObjectOrNull()))
return false;
break;
case MDefinition::Op_Unbox:
- MOZ_ASSERT(ndef->type() == MIRType_Object);
+ if (ndef->type() != MIRType_Object)
+ return true;
break;
case MDefinition::Op_TypeBarrier:
// For now, only handle type barriers which are not consumed
// anywhere and only test that the value is null.
if (ndef->hasUses() || ndef->resultTypeSet()->getKnownMIRType() != MIRType_Null)
return true;
break;
default: