new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1079062.js
@@ -0,0 +1,6 @@
+function f(y) {
+    return ((y ? y : 0) ? 0 : y)
+}
+m = [0xf]
+f(m[0])
+assertEq(f(m[0]), 0)

--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -1217,18 +1217,40 @@ MPhi::foldsTernary()
         return nullptr;
 
     MOZ_ASSERT(block()->numPredecessors() == 2);
 
     MBasicBlock *pred = block()->immediateDominator();
     if (!pred || !pred->lastIns()->isTest())
         return nullptr;
 
+    MTest *test = pred->lastIns()->toTest();
+
+    // True branch may only dominate one edge of MPhi.
+    if (test->ifTrue()->dominates(block()->getPredecessor(0)) &&
+        test->ifTrue()->dominates(block()->getPredecessor(1)))
+    {
+        return nullptr;
+    }
+
+    // False branch may only dominate one edge of MPhi.
+    if (test->ifFalse()->dominates(block()->getPredecessor(0)) &&
+        test->ifFalse()->dominates(block()->getPredecessor(1)))
+    {
+        return nullptr;
+    }
+
+    // True and false branch must dominate different edges of MPhi.
+    if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
+        test->ifFalse()->dominates(block()->getPredecessor(0)))
+    {
+        return nullptr;
+    }
+
     // We found a ternary construct.
-    MTest *test = pred->lastIns()->toTest();
     bool firstIsTrueBranch = test->ifTrue()->dominates(block()->getPredecessor(0));
     MDefinition *trueDef = firstIsTrueBranch ? getOperand(0) : getOperand(1);
     MDefinition *falseDef = firstIsTrueBranch ? getOperand(1) : getOperand(0);
 
     // Accept either
     // testArg ? testArg : constant or
     // testArg ? constant : testArg
     if (!trueDef->isConstant() && !falseDef->isConstant())