Bug 1205842: Don't add range asserts to recovered on bailouts instructions; r=nbp

--HG--
extra : commitid : CiHyGriq9B3
extra : rebase_source : e99244d4f1ed79ee00391d02626ef22f182a3fd2

js/src/jit-test/tests/ion/bug1205842.js

@@ -0,0 +1,8 @@
+function f(x) {
+    (function() {
+        x = 0;
+    })();
+}
+for (var k = 0; k < 9; k++) {
+    f(Math.fround(1));
+}

js/src/jit/RangeAnalysis.cpp

@@ -2291,6 +2291,10 @@ RangeAnalysis::addRangeAssertions()
             if (r.isUnknown() || (ins->type() == MIRType_Int32 && r.isUnknownInt32()))
                 continue;
 
+            // Don't add a use to an instruction that is recovered on bailout.
+            if (ins->isRecoveredOnBailout())
+                continue;
+
             MAssertRange* guard = MAssertRange::New(alloc(), ins, new(alloc()) Range(r));
 
             // Beta nodes and interrupt checks are required to be located at the