for (var i = 0; i < 2; ++i) { print(uneval(Math.max(-0))); } $ ./js-dbg-64-dm-clang-darwin-313a2d049350 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js -0 -0 $ ./js-dbg-64-dm-clang-darwin-313a2d049350 --fuzzing-safe --no-threads --ion-eager testcase.js -0 0 Tested this on m-c rev 313a2d049350. My configure flags are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 313a2d049350 autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/6e6438f5d89f user: André Bargull date: Thu Oct 06 23:38:16 2016 -0700 summary: Bug 1303788 - Add support for trailing comma in argument and parameter lists (ES2017). r=arai Andre, is bug 1303788 a likely regressor?

not likely, and I confirmed the same behavior on the parent revision of 6e6438f5d89f (95bf06da8e8d)

I re-ran autoBisect, this is probably more likely. autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/07e3fec694b1 user: ZongShen Shen date: Thu Jan 22 09:27:43 2015 -0800 summary: Bug 1123064 - IonMonkey: Fold constant numbers in MToInt32, r=h4writer Hannes/Andy, is bug 1123064 a likely regressor?

NumberIsInt32 also catches "-0", which NumberEqualsInt32 didn't do, causing this bug.

Comment on attachment 8801740 [details] [diff] [review] Patch Review of attachment 8801740 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit-test/tests/ion/bug1308802.js @@ +1,3 @@ > + > +function test() { > + for (var i = 0; i < 2; ++i) { maybe-nit: for (var i = false; !!i; i = inIon()) {

Pushed by hv1989@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/a9ee75a0ae5a IonMonkey - Folding ToInt32 shouldn't happen for negative zero, r=nbp