Bug 1117165 - IonMonkey: After replacing an instruction and deleting it, check whether the replacement has been deleted too. r=nbp

js/src/jit/ValueNumbering.cpp

@@ -749,6 +749,7 @@ ValueNumberer::visitDefinition(MDefinition *def)
         JitSpew(JitSpew_GVN, "      Folded %s%u to %s%u",
                 def->opName(), def->id(), sim->opName(), sim->id());
 #endif
+        MOZ_ASSERT(!sim->isDiscarded());
         ReplaceAllUsesWith(def, sim);
 
         // The node's foldsTo said |def| can be replaced by |rep|. If |def| is a
@@ -759,7 +760,13 @@ ValueNumberer::visitDefinition(MDefinition *def)
         if (DeadIfUnused(def)) {
             if (!discardDefsRecursively(def))
                 return false;
+
+            // If that ended up discarding |sim|, then we're done here.
+            if (sim->isDiscarded())
+                return true;
         }
+
+        // Otherwise, procede to optimize with |sim| in place of |def|.
         def = sim;
     }