The following testcase asserts on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m): function check(b, desc) { function ownProperties(obj) { return Object.getOwnPropertyNames(obj). map(function (p) { return [p, Object.getOwnPropertyDescriptor(obj, p)]; }); } function notIndex(p) { var u = p >>> 0; } function assertIsCloneOf(a, b, path) { var pa = ownProperties(a); var aNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex); var bNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex); } var banner = "while testing clone of " + (desc || uneval(b)); var a = deserialize(serialize(b)); var queue = [[a, b, banner]]; var triple = queue.shift(); assertIsCloneOf(triple[0], triple[1], triple[2]); } check({x: 0.7, p: "forty-two", y: null, z: undefined}); check([0, 1, 2, , 4, 5, 6]);

Test ./jit-test/tests/jaeger/bug593554.js fails identically with --ion --ion-eager -n.

Reuse BitOpV LIR, because MShiftOp use the Bitwise policy and as the same signature.

A problem with >>> is that it can return double values if the RHS is 0, see this testcase: function ursh(x, y) { return x >>> y; }; var o = {valueOf: function() { return -0x80000000; }}; for (var i=0; i<70; i++) assertEq(ursh(o, 0), 0x80000000);

Use LBinaryV instead of LBitOpV for the Value implementation of Ursh. - Fix issue in MUrsh::canOverflow (assumed that all constants were int32) - Fix issue in MIR shift annotations (MLsh, MRsh, MUrsh defined as commutative by MBinaryBitwiseInstruction::infer)

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug741202.js.