Don't demote multiplication, even if result is demoted and inputs are demotable (465308, r=danderson).

js/src/jstracer.cpp

@@ -767,7 +767,7 @@ public:
         } else if (ci == &js_DoubleToInt32_ci) {
             if (s0->isconstq())
                 return out->insImm(js_DoubleToECMAInt32(s0->constvalf()));
-            if (s0->isop(LIR_fadd) || s0->isop(LIR_fsub) || s0->isop(LIR_fmul)) {
+            if (s0->isop(LIR_fadd) || s0->isop(LIR_fsub)) {
                 LInsp lhs = s0->oprnd1();
                 LInsp rhs = s0->oprnd2();
                 if (isPromote(lhs) && isPromote(rhs)) {

js/src/trace-test.js

@@ -2493,6 +2493,14 @@ function testBranchCse() {
 testBranchCse.expected = "1,1,1,1,1,1,1,1,1,1";
 test(testBranchCse);
 
+function testMulOverflow() {
+    var a = [];
+    for (let j=0;j<5;++j) a.push(0 | ((0x60000009) * 0x60000009));
+    return a.join(",");
+}
+testMulOverflow.expected = "-1073741824,-1073741824,-1073741824,-1073741824,-1073741824";
+test(testMulOverflow);
+
 /* NOTE: Keep this test last, since it screws up all for...in loops after it. */
 function testGlobalProtoAccess() {
     return "ok";