From b7b4a74a9ec39e3ffbd2ede3b2645e5f60c10a65 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Tue, 19 Mar 2013 23:49:49 +0100
Subject: [PATCH] Bug 852140: IonMonkey: Backout bug 844452 and add testcase,
 r=nbp

---
 js/src/ion/TypePolicy.cpp              | 19 ++++++++++---------
 js/src/jit-test/tests/ion/bug852140.js |  7 +++++++
 2 files changed, 17 insertions(+), 9 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug852140.js

diff --git a/js/src/ion/TypePolicy.cpp b/js/src/ion/TypePolicy.cpp
index f95f929d7e6..954a39419ce 100644
--- a/js/src/ion/TypePolicy.cpp
+++ b/js/src/ion/TypePolicy.cpp
@@ -160,13 +160,17 @@ ComparePolicy::adjustInputs(MInstruction *def)
         return true;
     }
 
+    if (compare->compareType() == MCompare::Compare_Undefined ||
+        compare->compareType() == MCompare::Compare_Null)
+    {
+        // Nothing to do for undefined and null, lowering handles all types.
+        return true;
+    }
+
     // Convert all inputs to the right input type
     MIRType type = compare->inputType();
-
-    // Nothing to do for undefined and null, lowering handles all types.
-    if (type == MIRType_Undefined || type == MIRType_Null)
-        return true;
-
+    JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double ||
+              type == MIRType_Object || type == MIRType_String);
     for (size_t i = 0; i < 2; i++) {
         MDefinition *in = def->getOperand(i);
         if (in->type() == type)
@@ -175,11 +179,8 @@ ComparePolicy::adjustInputs(MInstruction *def)
         MInstruction *replace;
 
         // See BinaryArithPolicy::adjustInputs for an explanation of the following
-        if (in->type() == MIRType_Object || in->type() == MIRType_String ||
-            (in->type() == MIRType_Boolean && type != MIRType_Double && type != MIRType_Int32))
-        {
+        if (in->type() == MIRType_Object || in->type() == MIRType_String)
             in = boxAt(def, in);
-        }
 
         switch (type) {
           case MIRType_Double:
diff --git a/js/src/jit-test/tests/ion/bug852140.js b/js/src/jit-test/tests/ion/bug852140.js
new file mode 100644
index 00000000000..9d9986996b2
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug852140.js
@@ -0,0 +1,7 @@
+function reportCompare (expected, actual) {
+  if (expected != actual) {}
+}
+function exitFunc (funcName)
+  reportCompare(undefined, '');
+reportCompare('', '');
+exitFunc();