From 4ca1845f77056e6509f229fc509f3032e3e47afa Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@mozilla.com>
Date: Fri, 6 Feb 2015 10:54:32 -0800
Subject: [PATCH] Bug 1117165 - IonMonkey: After replacing an instruction and
 deleting it, check whether the replacement has been deleted too. r=nbp

---
 js/src/jit/ValueNumbering.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/js/src/jit/ValueNumbering.cpp b/js/src/jit/ValueNumbering.cpp
index 257f7513151..7f20c884d95 100644
--- a/js/src/jit/ValueNumbering.cpp
+++ b/js/src/jit/ValueNumbering.cpp
@@ -749,6 +749,7 @@ ValueNumberer::visitDefinition(MDefinition *def)
         JitSpew(JitSpew_GVN, "      Folded %s%u to %s%u",
                 def->opName(), def->id(), sim->opName(), sim->id());
 #endif
+        MOZ_ASSERT(!sim->isDiscarded());
         ReplaceAllUsesWith(def, sim);
 
         // The node's foldsTo said |def| can be replaced by |rep|. If |def| is a
@@ -759,7 +760,13 @@ ValueNumberer::visitDefinition(MDefinition *def)
         if (DeadIfUnused(def)) {
             if (!discardDefsRecursively(def))
                 return false;
+
+            // If that ended up discarding |sim|, then we're done here.
+            if (sim->isDiscarded())
+                return true;
         }
+
+        // Otherwise, procede to optimize with |sim| in place of |def|.
         def = sim;
     }