From aef716e1d5f06fba02ddcef8aa2096e3a9083f9c Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <benj@benj.me>
Date: Mon, 3 Nov 2014 14:06:26 +0100
Subject: [PATCH] Bug 1089769: Emitted at uses instructions should be added to
 the MIR graph in redefine; r=nbp

---
 js/src/jit/shared/Lowering-shared-inl.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index 061e629e2b4..65c3a12bf1e 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -212,17 +212,18 @@ LIRGeneratorShared::redefine(MDefinition *def, MDefinition *as)
           (def->type() == MIRType_Int32 || def->type() == MIRType_Boolean) &&
           (as->type() == MIRType_Int32 || as->type() == MIRType_Boolean))))
     {
-        MDefinition *replacement;
+        MInstruction *replacement;
         if (def->type() != as->type()) {
             Value v = as->toConstant()->value();
             if (as->type() == MIRType_Int32)
                 replacement = MConstant::New(alloc(), BooleanValue(v.toInt32()));
             else
                 replacement = MConstant::New(alloc(), Int32Value(v.toBoolean()));
+            def->block()->insertBefore(def->toInstruction(), replacement);
             if (!emitAtUses(replacement->toInstruction()))
                 return false;
         } else {
-            replacement = as;
+            replacement = as->toInstruction();
         }
         def->replaceAllUsesWith(replacement);
         return true;