function f(x) { return -Math.imul(x, x <= x) < -0 } x = [1, 0x80000000] for (var j = 0; j < 3; ++j) { for (var k = 0; k < 3; ++k) { print(f(x[j], x[k])) } } $ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --ion-parallel-compile=off 1482.js true true true false false false false false false $ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --ion-parallel-compile=off --ion-eager 1482.js true true true true true true false false false (Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 1ab07aa4d004, and I think it also reproduces on Linux) My configure flags (Mac) are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/9658dbcf4cd7 user: Dan Gohman date: Mon Dec 09 07:11:12 2013 -0800 summary: Bug 943303 - IonMonkey: Convert floating-point comparisons to integer using range analysis. r=nbp Dan, is bug 943303 a possible regressor?

Yes. And this is due to the same underlying problem as bug 998580.