function f(y) { (Math.max(-2147483649 >> 0, y >>> 0) | 0) >= false ? x : y } n = [0, -1] for (var j = 0; j < 2; ++j) { try { print(f(n[j])) } catch (e) {} } $ ./js-dbg-opt-64-dm-nsprBuild-darwin-b7650eab6339 --fuzzing-safe --no-threads --ion-eager 8236.js $ ./js-dbg-opt-64-dm-nsprBuild-darwin-b7650eab6339 --fuzzing-safe --no-threads --ion-eager --ion-check-range-analysis --no-sse3 8236.js undefined Tested this on m-c rev b7650eab6339. My configure flags are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests autoBisect is running.

Another bug that seems to go back before end-2013 ( https://hg.mozilla.org/mozilla-central/rev/df3c2a1e86d3 ). Jan, any idea how to move this forward?

Simpler test below. $ ./js/src/js --ion-eager --no-threads test.js test.js:7:0 Error: Assertion failed: got 1, expected 0 Works with --ion-range-analysis=off so I assume it's a RA bug. function f(y) { var x1 = Math.max(-2147483649 >> 0, y >>> 0); var x2 = x1 | 0; return (x2 >= 0) ? 1 : 0; } assertEq(f(0), 1); assertEq(f(-1), 0);

It also works with --ion-check-range-analysis. A bit weird, I hope that flag is not hiding bugs it should be catching.

I guess this is likely a similar issue as Bug 1122402. (In reply to Jan de Mooij [:jandem] from comment #3) > It also works with --ion-check-range-analysis. A bit weird, I hope that flag > is not hiding bugs it should be catching. The reason is that the guards inserted by the assertion are not removable, so "-1 >>> 0" is still executed, and bails as expected.

Is this fixed by the patch to bug 1122402?

Nope it isn't, but then again, the patch there didn't fix the issue in that bug either.

Testing with the fixed patch from Bug 1122402, I cannot reproduce the differential behavior reported in comment 2. I will push both test cases as part of Bug 1122402.

The bug is resolved; clearing needinfo.