Bug 1090037 - Ensure that dominators are defined enough before moving instructions. r=sunfish,h4writer

js/src/jit-test/tests/ion/bug1090037.js

@@ -0,0 +1,7 @@
+function f(x) {
+    Math.sin([] | 0 && x)
+}
+for (var j = 0; j < 1; j++) {
+    f(1 && 0)
+}
+

js/src/jit/MIR.cpp

@@ -1301,6 +1301,23 @@ MPhi::foldsTernary()
     if (testArg != test->input())
         return nullptr;
 
+    // This check should be a tautology, except that the constant might be the
+    // result of the removal of a branch.  In such case the domination scope of
+    // the block which is holding the constant might be incomplete. This
+    // condition is used to prevent doing this optimization based on incomplete
+    // information.
+    //
+    // As GVN removed a branch, it will update the dominations rules before
+    // trying to fold this MPhi again. Thus, this condition does not inhibit
+    // this optimization.
+    MBasicBlock *truePred = block()->getPredecessor(firstIsTrueBranch ? 0 : 1);
+    MBasicBlock *falsePred = block()->getPredecessor(firstIsTrueBranch ? 1 : 0);
+    if (!trueDef->block()->dominates(truePred) ||
+        !falseDef->block()->dominates(falsePred))
+    {
+        return nullptr;
+    }
+
     // If testArg is an int32 type we can:
     // - fold testArg ? testArg : 0 to testArg
     // - fold testArg ? 0 : testArg to 0

js/src/jit/ValueNumbering.cpp

@@ -654,6 +654,10 @@ ValueNumberer::leader(MDefinition *def)
             if (!values_.add(p, def))
                 return nullptr;
         }
+
+#ifdef DEBUG
+        JitSpew(JitSpew_GVN, "      Recording %s%u", def->opName(), def->id());
+#endif
     }
 
     return def;