--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -300,17 +300,17 @@ Poison(void* ptr, uint8_t value, size_t 
     static bool poison = !bool(getenv("JSGC_DISABLE_POISONING"));
     if (poison) {
         // Without a valid Value tag, a poisoned Value may look like a valid
         // floating point number. To ensure that we crash more readily when
         // observing a poised Value, we make the poison an invalid ObjectValue.
         uintptr_t obj;
         memset(&obj, value, sizeof(obj));
 #if defined(JS_PUNBOX64)
-        obj >>= JSVAL_TAG_SHIFT;
+        obj = obj & ((uintptr_t(1) << JSVAL_TAG_SHIFT) - 1);
 #endif
         const jsval_layout layout = OBJECT_TO_JSVAL_IMPL((JSObject*)obj);
 
         size_t value_count = num / sizeof(jsval_layout);
         size_t byte_count = num % sizeof(jsval_layout);
         mozilla::PodSet((jsval_layout*)ptr, layout, value_count);
         if (byte_count) {
             uint8_t* bytes = static_cast<uint8_t*>(ptr);