function f(y) { return -0 == (0 / y) } f(1) print(f(0)) $ ./js-opt-64-dm-ts-darwin-265d82091bce --fuzzing-safe --ion-parallel-compile=off 11503.js false $ ./js-opt-64-dm-ts-darwin-265d82091bce --fuzzing-safe --ion-parallel-compile=off --ion-eager 11503.js true (Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 265d82091bce) My configure flags (Mac) are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options> This still reproduces with a 32-bit Mac shell compiled with "-msse2 -mfpmath=sse": LD=ld CROSS_COMPILE=1 CC="clang -msse2 -mfpmath=sse -Qunused-arguments -arch i386" RANLIB=ranlib CXX="clang++ -msse2 -mfpmath=sse -Qunused-arguments -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -msse2 -mfpmath=sse -Qunused-arguments" HOST_CXX="clang++ -msse2 -mfpmath=sse -Qunused-arguments" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/9658dbcf4cd7 user: Dan Gohman date: Mon Dec 09 07:11:12 2013 -0800 summary: Bug 943303 - IonMonkey: Convert floating-point comparisons to integer using range analysis. r=nbp Dan, is bug 943303 a likely regressor?

This is fixed by the fix for bug 995817.