Bug 1247880 - Only remove MUrsh operands when the input of MUrsh is guaranteed to be unsigned. r=sunfish

js/src/jit-test/tests/asm.js/bug940864.js

@@ -0,0 +1,10 @@
+function a()
+{
+    "use asm";
+    function f()
+    {
+        return (((((-1) >>> (0+0)) | 0) % 10000) >> (0+0)) | 0;
+    }
+    return f;
+}
+assertEq(a()(), -1);

js/src/jit-test/tests/ion/bug1247880.js

@@ -0,0 +1,12 @@
+function f(x) {
+    var a = x;
+    a = Number ? a | 0 : 0;
+    a = a >>> 0;
+    a = Math.imul(0x100000001, a);
+    a = a % 2;
+    a = a | 0;
+    return a;
+};
+
+assertEq(f(0), 0);
+assertEq(f(-1), -1);

js/src/jit/MIR.cpp

@@ -3197,7 +3197,7 @@ MustBeUInt32(MDefinition* def, MDefinition** pwrapped)
     if (def->isUrsh()) {
         *pwrapped = def->toUrsh()->lhs();
         MDefinition* rhs = def->toUrsh()->rhs();
-        return !def->toUrsh()->bailoutsDisabled() &&
+        return def->toUrsh()->bailoutsDisabled() &&
                rhs->maybeConstantValue() &&
                rhs->maybeConstantValue()->isInt32(0);
     }