Bug 1314438: Follow-up fix to only guard if it isn't a guard already ON CLOSED TREE, r=bustage

js/src/jit/MIR.cpp

@@ -2390,7 +2390,8 @@ MPhi::foldsTernary(TempAllocator& alloc)
     // - fold testArg ? testArg : 0 to testArg
     // - fold testArg ? 0 : testArg to 0
     if (testArg->type() == MIRType::Int32 && c->numberToDouble() == 0) {
-        testArg->setGuardRangeBailoutsUnchecked();
+        if (DeadIfUnused(testArg))
+            testArg->setGuardRangeBailoutsUnchecked();
 
         // When folding to the constant we need to hoist it.
         if (trueDef == c && !c->block()->dominates(block()))
@@ -4393,7 +4394,8 @@ MCompare::tryFoldEqualOperands(bool* result)
             return false;
     }
 
-    lhs()->setGuardRangeBailoutsUnchecked();
+    if (DeadIfUnused(lhs()))
+        lhs()->setGuardRangeBailoutsUnchecked();
 
     *result = (jsop() == JSOP_STRICTEQ);
     return true;

js/src/jit/ValueNumbering.cpp

@@ -796,8 +796,10 @@ ValueNumberer::visitDefinition(MDefinition* def)
         // needed, so we can clear |def|'s guard flag and let it be discarded.
         def->setNotGuardUnchecked();
 
-        if (def->isGuardRangeBailouts())
-            sim->setGuardRangeBailoutsUnchecked();
+        if (def->isGuardRangeBailouts()) {
+            if (DeadIfUnused(sim))
+                sim->setGuardRangeBailoutsUnchecked();
+        }
 
         if (DeadIfUnused(def)) {
             if (!discardDefsRecursively(def))