Bug 1085298 - IonMonkey: Fix for when folding ternary constructs and a branch dominates both MPhi predecessors, r=nbp