Bug 1034400: Make RNot recover in all cases and not assert on objects; r=nbp

js/src/jit-test/tests/ion/bug1034400.js

@@ -0,0 +1,28 @@
+var countG = 0;
+function g() {
+    switch(countG++) {
+     case 0: return 42;
+     case 1: return "yo";
+     case 2: return {};
+    }
+}
+
+var countFault = 0;
+function uceFault() {
+    if (countFault++ == 4)
+        uceFault = function() { return true }
+    return false;
+}
+
+function f() {
+    var x = !g();
+    if (uceFault() || uceFault()) {
+        assertEq(x, false);
+        return 0;
+    }
+    return 1;
+}
+
+f();
+f();
+f();

js/src/jit/MIR.h

@@ -6255,11 +6255,7 @@ class MNot
     }
     bool writeRecoverData(CompactBufferWriter &writer) const;
     bool canRecoverOnBailout() const {
-        // Non objects are recoverable and objects that cannot emulate
-        // undefined get folded into 'true' by GVN.
-        // So the only way to reach this function with an operand that
-        // is an object is when that object might emulate undefined.
-        return !operandMightEmulateUndefined_;
+        return true;
     }
 };
 

js/src/jit/Recover.cpp

@@ -501,7 +501,6 @@ RNot::recover(JSContext *cx, SnapshotIterator &iter) const
     RootedValue v(cx, iter.read());
     RootedValue result(cx);
 
-    MOZ_ASSERT(!v.isObject());
     result.setBoolean(!ToBoolean(v));
 
     iter.storeInstructionResult(result);