Bug 913749 - Mark fallible unbox instructions as guards. r=h4writer

--HG--
extra : rebase_source : f064535983782dcd52791f977f16a21d83603381

js/src/jit-test/tests/ion/bug913749.js

@@ -0,0 +1,20 @@
+y = Float32Array(11);
+x = [];
+
+Object.defineProperty(x, 18, {
+    get: (function() {
+        y.length;
+    }),
+});
+this.toSource();
+
+y = undefined;
+
+for (var i = 0; i < 3; i++) {
+    try {
+	x.toString();
+	assertEq(0, 1);
+    } catch (e) {
+	assertEq(e.message, "y is undefined");
+    }
+}

js/src/jit/MIR.h

@@ -2197,7 +2197,7 @@ class MUnbox : public MUnaryInstruction, public BoxInputsPolicy
         setResultTypeSet(ins->resultTypeSet());
         setMovable();
 
-        if (mode_ == TypeBarrier)
+        if (mode_ == TypeBarrier || mode_ == Fallible)
             setGuard();
 
         bailoutKind_ = kind;