Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/1dd0ca8e70bd

# HG changeset patch
# User Nicolas B. Pierron <nicolas.b.pierron@mozilla.com>
# Date 1456161361 0
# Node ID 1dd0ca8e70bd77b6fd93f36cc4e9c2cebfe8ba0a
# Parent  95ff874886905ef46a7bbc760981d15ad0831096
Bug 1221872 - ValueNumbering: Set the dominator index of fixup blocks when they are created. r=sunfish, a=ritu

diff --git a/js/src/jit/ValueNumbering.cpp b/js/src/jit/ValueNumbering.cpp
--- a/js/src/jit/ValueNumbering.cpp
+++ b/js/src/jit/ValueNumbering.cpp
@@ -433,16 +433,17 @@ ValueNumberer::fixupOSROnlyLoop(MBasicBl
     MBasicBlock* fake = MBasicBlock::NewAsmJS(graph_, block->info(),
                                               nullptr, MBasicBlock::NORMAL);
     if (fake == nullptr)
         return false;
 
     graph_.insertBlockBefore(block, fake);
     fake->setImmediateDominator(fake);
     fake->addNumDominated(1);
+    fake->setDomIndex(fake->id());
 
     // Create zero-input phis to use as inputs for any phis in |block|.
     // Again, this is a little odd, but it's the least-odd thing we can do
     // without significant complexity.
     for (MPhiIterator iter(block->phisBegin()), end(block->phisEnd()); iter != end; ++iter) {
         MPhi* phi = *iter;
         MPhi* fakePhi = MPhi::New(graph_.alloc(), phi->type());
         fake->addPhi(fakePhi);