function f(x) { return (x >> 0 ? Math.fround(x >> Math) + Math.fround(Math.asinh(-0xf) >>> 0) : Math.w); }; function g(y) { return !f(f(Math.hypot(~y))) * Math.round(1); }; for (var i = 0; i < 999; ++i) { print(g()); } $ ./js-dbg-64-dm-clang-darwin-c4449eab07d3 --fuzzing-safe --no-threads --ion-eager testcase.js $ ./js-dbg-64-dm-clang-darwin-c4449eab07d3 --fuzzing-safe --ion-eager --ion-pgo=on testcase.js Diff'ing between the 2 outputs show: @@ -341,7 +341,7 @@ 0 0 0 -0 +1 0 0 0 Tested this on m-c rev c4449eab07d3. My configure flags are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r c4449eab07d3 This testcase can be intermittent. This essentially blocks compareJIT testing with --ion-pgo=on. autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/2e29695fee87 user: Nicolas B. Pierron date: Tue May 17 17:15:53 2016 +0000 summary: Bug 1261826 part 10 - Only increment code coverage counters on jump targets. r=bhackett Nicolas, is bug 1261826 a likely regressor?

Actually, I'll turn off --ion-pgo=on testing until this is fixed.

Ok, this sounds like a real issue, I will investigate more, in the mean time Bug 1261826 part 10.1 should "hide" the current issue, but I do not think this a proper fix for this issue. I expect to land Bug 1261826 part 10.1 as soon as inbound re-open, so you might be able to turn pgo=on fuzzing again after that.

This issue should no longer reproduce after https://hg.mozilla.org/integration/mozilla-inbound/rev/c2b51f5ad843 , but I will keep investigating until I fully understand what is going on.

per comment 3, this issue is fixed, and there is no need to keep it open.