Bug 1071879 - IonMonkey: Hoist operand when folding ternary structure, r=nbp