diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 48d77bff2ad..50e2e477469 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -5648,7 +5648,8 @@ TraceRecorder::record_JSOP_NEG()
          */
         if (isPromoteInt(a) &&
             (!JSVAL_IS_INT(v) || JSVAL_TO_INT(v) != 0) &&
-            (!JSVAL_IS_DOUBLE(v) || !JSDOUBLE_IS_NEGZERO(*JSVAL_TO_DOUBLE(v))))  {
+            (!JSVAL_IS_DOUBLE(v) || !JSDOUBLE_IS_NEGZERO(*JSVAL_TO_DOUBLE(v))) &&
+            -asNumber(v) == (int)-asNumber(v)) {
             a = lir->ins1(LIR_neg, ::demote(lir, a));
             lir->insGuard(LIR_xt, lir->ins1(LIR_ov, a), snapshot(OVERFLOW_EXIT));
             lir->insGuard(LIR_xt, lir->ins2(LIR_eq, a, lir->insImm(0)), snapshot(OVERFLOW_EXIT));
diff --git a/js/src/trace-test.js b/js/src/trace-test.js
index 8e89a224d4c..801b665e34e 100644
--- a/js/src/trace-test.js
+++ b/js/src/trace-test.js
@@ -1940,6 +1940,14 @@ function testBug466128() {
 testBug466128.expected = true;
 test(testBug466128);
 
+//test no assert
+function testBug465688() {
+    for each (let d in [-0x80000000, -0x80000000]) - -d;
+    return true;
+}
+testBug465688.expected = true;
+test(testBug465688);
+
 // BEGIN MANDELBROT STUFF
 // XXXbz I would dearly like to wrap it up into a function to avoid polluting
 // the global scope, but the function ends up heavyweight, and then we lose on