new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1062612.js
@@ -0,0 +1,7 @@
+x = [0, 1, 1, 0, 1, 1];
+y = -1;
+sum = 0;
+for (var j = 0; j < x.length; ++j) {
+    sum = sum + (x[j] ? 0 : (y >>> 0)) | 0;
+}
+assertEq(sum, -2);

--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -2613,17 +2613,17 @@ AdjustTruncatedInputs(TempAllocator &all
         } else {
             MInstruction *op;
             if (kind == MDefinition::TruncateAfterBailouts)
                 op = MToInt32::New(alloc, truncated->getOperand(i));
             else
                 op = MTruncateToInt32::New(alloc, truncated->getOperand(i));
 
             if (truncated->isPhi()) {
-                MBasicBlock *pred = op->block()->getPredecessor(i);
+                MBasicBlock *pred = block->getPredecessor(i);
                 pred->insertBefore(pred->lastIns(), op);
             } else {
                 block->insertBefore(truncated->toInstruction(), op);
             }
             truncated->replaceOperand(i, op);
         }
     }