--- a/js/src/jit-test/tests/ion/dce-with-rinstructions.js
+++ b/js/src/jit-test/tests/ion/dce-with-rinstructions.js
@@ -414,19 +414,18 @@ function rfloor_object(i) {
     assertRecoveredOnBailout(x, false);
     return i;
 }
 
 var uceFault_ceil_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_ceil_number'));
 function rceil_number(i) {
     var x = Math.ceil(-i - 0.12010799100);
     if (uceFault_ceil_number(i) || uceFault_ceil_number(i))
-        assertEq(x, - i);
-    // NYI: uses MMathFunction and not MCeil.
-    // assertRecoveredOnBailout(x, true);
+        assertEq(x, -i);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
 var uceFault_round_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_round'));
 function rround_number(i) {
     var x = Math.round(i + 1.4);
     if (uceFault_round_number(i) || uceFault_round_number(i))
         assertEq(x, 100); /* = i + 1*/

--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -308,17 +308,17 @@ js::math_ceil_impl(double x)
 bool
 js::math_ceil_handle(JSContext *cx, HandleValue v, MutableHandleValue res)
 {
     double d;
     if(!ToNumber(cx, v, &d))
         return false;
 
     double result = math_ceil_impl(d);
-    res.setDouble(result);
+    res.setNumber(result);
     return true;
 }
 
 bool
 js::math_ceil(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);