+++ This bug was initially created as a clone of Bug #969203 +++ function f(x) { return -(~x) < (x >>> 0) } print(f([])) print(f(undefined - undefined)) print(f(-0x80000001)) $ ./js-opt-32-dm-ts-er-linux-262e73a6b7cd --fuzzing-safe --ion-parallel-compile=off --ion-eager testcase.js false false true $ ./js-opt-32-dm-ts-er-linux-262e73a6b7cd --fuzzing-safe --ion-parallel-compile=off testcase.js false false false Tested on js 32-bit opt threadsafe shell on m-c changeset 262e73a6b7cd on Linux, as well as 64-bit debug threadsafe shell. My configure flags are: CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options> autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/9658dbcf4cd7 user: Dan Gohman date: Mon Dec 09 07:11:12 2013 -0800 summary: Bug 943303 - IonMonkey: Convert floating-point comparisons to integer using range analysis. r=nbp Dan, is bug 943303 a likely regressor?

> Dan, is bug 943303 a likely regressor? Yes. When range analysis converts a comparison to int32, truncation of the operands doesn't change the result, but it turns out comparisons can also be converted to int32 by speculative type inference, in which case it isn't necessarily safe to truncate the operands. The attached patch adds a flag to MCompare to track whether the operands should be truncated.

Comment on attachment 8373525 [details] [diff] [review] truncated-compare.patch Review of attachment 8373525 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit/MIR.h @@ +2256,5 @@ > > + // When a floating-point comparison is converted to an integer comparison > + // (when range analysis proves it safe), we need to convert the operands > + // to integer comparisons as well. > + bool truncateOperands_; nit: … we need to convert the operands to integer as well.

Updated patch with bug number and reviewer.