From df4976ee5531c67ee15a0db901baa161c3a10f9d Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Mon, 7 Nov 2016 10:20:56 +0100
Subject: [PATCH] Bug 1314438: Follow-up fix to only guard if it isn't a guard
 already ON CLOSED TREE, r=bustage

---
 js/src/jit/MIR.cpp            | 6 ++++--
 js/src/jit/ValueNumbering.cpp | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 9421e7a28986..f1a8970ce361 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2390,7 +2390,8 @@ MPhi::foldsTernary(TempAllocator& alloc)
     // - fold testArg ? testArg : 0 to testArg
     // - fold testArg ? 0 : testArg to 0
     if (testArg->type() == MIRType::Int32 && c->numberToDouble() == 0) {
-        testArg->setGuardRangeBailoutsUnchecked();
+        if (DeadIfUnused(testArg))
+            testArg->setGuardRangeBailoutsUnchecked();
 
         // When folding to the constant we need to hoist it.
         if (trueDef == c && !c->block()->dominates(block()))
@@ -4393,7 +4394,8 @@ MCompare::tryFoldEqualOperands(bool* result)
             return false;
     }
 
-    lhs()->setGuardRangeBailoutsUnchecked();
+    if (DeadIfUnused(lhs()))
+        lhs()->setGuardRangeBailoutsUnchecked();
 
     *result = (jsop() == JSOP_STRICTEQ);
     return true;
diff --git a/js/src/jit/ValueNumbering.cpp b/js/src/jit/ValueNumbering.cpp
index a62be6eb9911..470ddf9aa007 100644
--- a/js/src/jit/ValueNumbering.cpp
+++ b/js/src/jit/ValueNumbering.cpp
@@ -796,8 +796,10 @@ ValueNumberer::visitDefinition(MDefinition* def)
         // needed, so we can clear |def|'s guard flag and let it be discarded.
         def->setNotGuardUnchecked();
 
-        if (def->isGuardRangeBailouts())
-            sim->setGuardRangeBailoutsUnchecked();
+        if (def->isGuardRangeBailouts()) {
+            if (DeadIfUnused(sim))
+                sim->setGuardRangeBailoutsUnchecked();
+        }
 
         if (DeadIfUnused(def)) {
             if (!discardDefsRecursively(def))