Don't attempt to do CSE across labels (465276, r=danderson).

js/src/nanojit/LIR.cpp

@@ -1910,6 +1910,13 @@ namespace nanojit
 		return exprs.add(out->insImmq(q), k);
 	}
 
+	LIns* CseFilter::ins0(LOpcode v)
+	{
+	    if (v == LIR_label)
+	        exprs.clear();
+	    return out->ins0(v);
+	}
+	
 	LIns* CseFilter::ins1(LOpcode v, LInsp a)
 	{
 		if (isCse(v)) {

js/src/nanojit/LIR.h

@@ -654,6 +654,12 @@ namespace nanojit
         LIns* insAlloc(int32_t size) {
             return add(out->insAlloc(size));
         }
+        LIns* insImm(int32_t imm) {
+            return add(out->insImm(imm));
+        }
+        LIns* insImmq(uint64_t imm) {
+            return add(out->insImmq(imm));
+        }
     };
 
 #endif
@@ -712,6 +718,7 @@ namespace nanojit
 		CseFilter(LirWriter *out, avmplus::GC *gc);
 	    LIns* insImm(int32_t imm);
 	    LIns* insImmq(uint64_t q);
+	    LIns* ins0(LOpcode v);
 		LIns* ins1(LOpcode v, LInsp);
 		LIns* ins2(LOpcode v, LInsp, LInsp);
 		LIns* insLoad(LOpcode v, LInsp b, LInsp d);

js/src/trace-test.js

@@ -2476,6 +2476,15 @@ function testIn() {
 testIn.expected = "true,true,true,true,true,false,false,false,false,false,true,true,true,true,true,false,false,false,false,false,true,true,true,true,true,false,false,false,false,false,true,true,true,true,true,false,false,false,false,false,true,true,true,true,true,false,false,false,false,false";
 test(testIn);
 
+function testBranchCse() {
+    empty = [];
+    out = [];
+    for (var j=0;j<10;++j) { empty[42]; out.push((1 * (1)) | ""); }
+    return out.join(",");
+}
+testBranchCse.expected = "1,1,1,1,1,1,1,1,1,1";
+test(testBranchCse);
+
 /* NOTE: Keep this test last, since it screws up all for...in loops after it. */
 function testGlobalProtoAccess() {
     return "ok";