From 55c7b88f8481d6642f32c54f50ff93b2b4b48cfc Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 7 May 2015 02:58:27 +0200
Subject: [PATCH] Bug 1159899: IonMonkey: Fix folding of ~~x, r=nbp

---
 js/src/jit-test/tests/ion/bug1159899.js | 5 +++++
 js/src/jit/MIR.cpp                      | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1159899.js

diff --git a/js/src/jit-test/tests/ion/bug1159899.js b/js/src/jit-test/tests/ion/bug1159899.js
new file mode 100644
index 00000000000..10d930f3b90
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1159899.js
@@ -0,0 +1,5 @@
+function f(x) {
+        return ~~(x >>> 0) / (x >>> 0) | 0
+}
+f(1)
+assertEq(f(-1), 0);
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index b19dc5fe71f..071733bd72f 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2977,7 +2977,7 @@ MBitNot::foldsTo(TempAllocator& alloc)
 
     if (input->isBitNot() && input->toBitNot()->specialization_ == MIRType_Int32) {
         MOZ_ASSERT(input->toBitNot()->getOperand(0)->type() == MIRType_Int32);
-        return input->toBitNot()->getOperand(0); // ~~x => x
+        return MTruncateToInt32::New(alloc, input->toBitNot()->input()); // ~~x => x | 0
     }
 
     return this;