Make sure we create loop body slot opnd as signed int.

lib/Backend/IRBuilderAsmJs.cpp

@@ -3334,6 +3334,8 @@ IRBuilderAsmJs::InsertLoopBodyReturnIPInstr(uint targetOffset, uint offset)
 IR::SymOpnd *
 IRBuilderAsmJs::BuildAsmJsLoopBodySlotOpnd(SymID symId, IRType opndType)
 {
+    // There is no unsigned locals, make sure we create only signed locals
+    opndType = IRType_EnsureSigned(opndType);
     // Get the interpreter frame instance that was passed in.
     StackSym *loopParamSym = m_func->EnsureLoopParamSym();
 

lib/Backend/IRType.cpp

@@ -57,6 +57,24 @@ bool IRType_IsSimd128(IRType type)
     return type >= TySimd128F4 && type <= TySimd128D2;
 }
 
+IRType IRType_EnsureSigned(IRType type)
+{
+    if (IRType_IsUnsignedInt(type))
+    {
+        return (IRType)(type - (TyUint8 - TyInt8));
+    }
+    return type;
+}
+
+IRType IRType_EnsureUnsigned(IRType type)
+{
+    if (IRType_IsSignedInt(type))
+    {
+        return (IRType)(type + (TyUint8 - TyInt8));
+    }
+    return type;
+}
+
 #if DBG_DUMP || defined(ENABLE_IR_VIEWER)
 void IRType_Dump(IRType type)
 {

lib/Backend/IRType.h

@@ -32,6 +32,8 @@ extern bool IRType_IsNativeInt(IRType type);
 extern bool IRType_IsInt64(IRType type);
 extern bool IRType_IsSimd(IRType type);
 extern bool IRType_IsSimd128(IRType type);
+extern IRType IRType_EnsureSigned(IRType type);
+extern IRType IRType_EnsureUnsigned(IRType type);
 
 #if DBG_DUMP || defined(ENABLE_IR_VIEWER)
 extern void IRType_Dump(IRType type);

test/AsmJs/bug9883547.js

@@ -0,0 +1,20 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function AsmModule() {
+  "use asm";
+  function f() {
+    var a = 0, b = 0.0;
+    while((b) == 0.0) {
+      b = +(a>>>0); // First use of a in the loop as a uint32
+      a = 5|0; // def of a in the loop as an int32
+    }
+    return +b;
+  }
+  return f;
+}
+
+var f = AsmModule();
+console.log("PASSED");

test/AsmJs/rlexe.xml

@@ -843,6 +843,11 @@
       <files>bugGH2270.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug9883547.js</files>
+    </default>
+  </test>
   <test>
     <default>
       <files>constFoldTests.js</files>