Created attachment 620068 [details] [diff] [review]
If the input to a StoreSlot is typed, but TI does not know the type of the slot, and write barriers are necessary, we crash due to trying to coerce MIRType_None into a JSValueType.
This just changes the default slot value to be MIRType_Value, and then puts machinery to convert that MIRType to JSVAL_TYPE_UNKNOWN. Fixes an --ion-eager failure.
Created attachment 620088 [details] [diff] [review]
Fix v2, using MIRType
Prevents changes to ValueFromMIRType() by just using the MIRType directly.
*** Bug 737297 has been marked as a duplicate of this bug. ***