ion/inlining/inline-callarg-bailout-phi.js triggers this assert with --ion -n

This is a GVN bug. The greedy allocator does not assert but gives incorrect results for the following testcase: -- function add(x, y) { var z; if (x & 0x1) z = x + y; else z = x + y; return z; } for(var i=0; i<100; i++) { print(add(i, i)); } -- GVN removes the second x + y, which seems bogus.

MPhi::foldsTo looks at the value numbers of its operands, and if they are equal, the MPhi is folded to the first operand. The problem is, unlike ValueNumberer::findDominatingDef, this does not consider the dominator tree. So, for the testcase in comment 1, the phi is replaced with the first "x + y"...

Let's do the easy fix for now and just only eliminate phis based on ssa name, rather than value numbers.