From f7ee19b62d375cb0437c7f94e54309ab8c457be8 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Mon, 3 Jun 2013 11:56:35 -0600
Subject: [PATCH] Bug 878627 - Give an empty result type set to binops with an
 empty lhs or rhs type set, r=djvj.

---
 js/src/ion/MIR.cpp | 16 ++++++++++++++++
 js/src/ion/MIR.h   |  1 +
 2 files changed, 17 insertions(+)

diff --git a/js/src/ion/MIR.cpp b/js/src/ion/MIR.cpp
index 51f0729d49f..81b1b2ccaa2 100644
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -315,6 +315,12 @@ MDefinition::replaceAllUsesWith(MDefinition *dom)
     }
 }
 
+bool
+MDefinition::emptyResultTypeSet() const
+{
+    return resultTypeSet() && resultTypeSet()->empty();
+}
+
 static inline bool
 IsPowerOfTwo(uint32_t n)
 {
@@ -1338,6 +1344,16 @@ MBinaryArithInstruction::inferFallback(BaselineInspector *inspector,
         setResultType(MIRType_Double);
         return;
     }
+
+    // If we can't specialize because we have no type information at all for
+    // the lhs or rhs, mark the binary instruction as having no possible types
+    // either to avoid degrading subsequent analysis.
+    if (getOperand(0)->emptyResultTypeSet() || getOperand(1)->emptyResultTypeSet()) {
+        LifoAlloc *alloc = GetIonContext()->temp->lifoAlloc();
+        types::StackTypeSet *types = alloc->new_<types::StackTypeSet>();
+        if (types)
+            setResultTypeSet(types);
+    }
 }
 
 static bool
diff --git a/js/src/ion/MIR.h b/js/src/ion/MIR.h
index 66837866ebb..ed18b890fa5 100644
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -404,6 +404,7 @@ class MDefinition : public MNode
     types::StackTypeSet *resultTypeSet() const {
         return resultTypeSet_;
     }
+    bool emptyResultTypeSet() const;
 
     bool mightBeType(MIRType type) const {
         JS_ASSERT(type != MIRType_Value);