Merge branch 'master' into releaseRC_20230901RB_20230904

1 files changed, 9 insertions, 1 deletions

diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 1c80c74716..d315c618e7 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -717,6 +717,10 @@ LIRGenerator::visitTest(MTest* test)
     // TestPolicy).
     MOZ_ASSERT(opd->type() != MIRType::String);
 
+    // BigInt is boxed in type analysis.
+    MOZ_ASSERT(opd->type() != MIRType::BigInt,
+               "BigInt should be boxed by TestPolicy");
+
     // Testing a constant.
     if (MConstant* constant = opd->maybeConstantValue()) {
         bool b;
@@ -2149,9 +2153,11 @@ LIRGenerator::visitToInt32(MToInt32* convert)
 
       case MIRType::String:
       case MIRType::Symbol:
+      case MIRType::BigInt:
       case MIRType::Object:
       case MIRType::Undefined:
-        // Objects might be effectful. Symbols throw. Undefined coerces to NaN, not int32.
+        // Objects might be effectful. Symbols and BigInts throw. Undefined
+        // coerces to NaN, not int32.
         MOZ_CRASH("ToInt32 invalid input type");
 
       default:
@@ -2939,6 +2945,8 @@ LIRGenerator::visitNot(MNot* ins)
     // String is converted to length of string in the type analysis phase (see
     // TestPolicy).
     MOZ_ASSERT(op->type() != MIRType::String);
+    MOZ_ASSERT(op->type() != MIRType::BigInt,
+               "BigInt should be boxed by TestPolicy");
 
     // - boolean: x xor 1
     // - int32: LCompare(x, 0)