Bug 1085298 - IonMonkey: Fix for when folding ternary constructs and a branch dominates both MPhi predecessors, r=nbp

js/src/jit-test/tests/ion/bug1085298.js

@@ -0,0 +1,7 @@
+function f(x, y) {
+        return (y | 0 && x ? y | 0 : 0)
+}
+m = [1]
+assertEq(f(m[0], m[0]), 1)
+assertEq(f(m[1], m[0]), 0)
+assertEq(f(m[2], m[0]), 0)

js/src/jit/MIR.cpp

@@ -1265,14 +1265,14 @@ MPhi::foldsTernary()
     MTest *test = pred->lastIns()->toTest();
 
     // True branch may only dominate one edge of MPhi.
-    if (test->ifTrue()->dominates(block()->getPredecessor(0)) &&
+    if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
         test->ifTrue()->dominates(block()->getPredecessor(1)))
     {
         return nullptr;
     }
 
     // False branch may only dominate one edge of MPhi.
-    if (test->ifFalse()->dominates(block()->getPredecessor(0)) &&
+    if (test->ifFalse()->dominates(block()->getPredecessor(0)) ==
         test->ifFalse()->dominates(block()->getPredecessor(1)))
     {
         return nullptr;