From 26a262542caaa71a212ce349a6f84fd7dae4292d Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Tue, 8 Mar 2016 12:54:19 +0000
Subject: [PATCH] Bug 1247880 - Only remove MUrsh operands when the input of
 MUrsh is guaranteed to be unsigned. r=sunfish

---
 js/src/jit-test/tests/asm.js/bug940864.js | 10 ++++++++++
 js/src/jit-test/tests/ion/bug1247880.js   | 12 ++++++++++++
 js/src/jit/MIR.cpp                        |  2 +-
 3 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/asm.js/bug940864.js
 create mode 100644 js/src/jit-test/tests/ion/bug1247880.js

diff --git a/js/src/jit-test/tests/asm.js/bug940864.js b/js/src/jit-test/tests/asm.js/bug940864.js
new file mode 100644
index 000000000000..4df37bb40040
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/bug940864.js
@@ -0,0 +1,10 @@
+function a()
+{
+    "use asm";
+    function f()
+    {
+        return (((((-1) >>> (0+0)) | 0) % 10000) >> (0+0)) | 0;
+    }
+    return f;
+}
+assertEq(a()(), -1);
diff --git a/js/src/jit-test/tests/ion/bug1247880.js b/js/src/jit-test/tests/ion/bug1247880.js
new file mode 100644
index 000000000000..af5bbf93adf1
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1247880.js
@@ -0,0 +1,12 @@
+function f(x) {
+    var a = x;
+    a = Number ? a | 0 : 0;
+    a = a >>> 0;
+    a = Math.imul(0x100000001, a);
+    a = a % 2;
+    a = a | 0;
+    return a;
+};
+
+assertEq(f(0), 0);
+assertEq(f(-1), -1);
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index aabd4348469e..29e37bf3be77 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3197,7 +3197,7 @@ MustBeUInt32(MDefinition* def, MDefinition** pwrapped)
     if (def->isUrsh()) {
         *pwrapped = def->toUrsh()->lhs();
         MDefinition* rhs = def->toUrsh()->rhs();
-        return !def->toUrsh()->bailoutsDisabled() &&
+        return def->toUrsh()->bailoutsDisabled() &&
                rhs->maybeConstantValue() &&
                rhs->maybeConstantValue()->isInt32(0);
     }