new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1085298.js
@@ -0,0 +1,7 @@
+function f(x, y) {
+        return (y | 0 && x ? y | 0 : 0)
+}
+m = [1]
+assertEq(f(m[0], m[0]), 1)
+assertEq(f(m[1], m[0]), 0)
+assertEq(f(m[2], m[0]), 0)

--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -1260,24 +1260,24 @@ MPhi::foldsTernary()
 
     MBasicBlock *pred = block()->immediateDominator();
     if (!pred || !pred->lastIns()->isTest())
         return nullptr;
 
     MTest *test = pred->lastIns()->toTest();
 
     // True branch may only dominate one edge of MPhi.
-    if (test->ifTrue()->dominates(block()->getPredecessor(0)) &&
+    if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
         test->ifTrue()->dominates(block()->getPredecessor(1)))
     {
         return nullptr;
     }
 
     // False branch may only dominate one edge of MPhi.
-    if (test->ifFalse()->dominates(block()->getPredecessor(0)) &&
+    if (test->ifFalse()->dominates(block()->getPredecessor(0)) ==
         test->ifFalse()->dominates(block()->getPredecessor(1)))
     {
         return nullptr;
     }
 
     // True and false branch must dominate different edges of MPhi.
     if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
         test->ifFalse()->dominates(block()->getPredecessor(0)))