Bug 831087 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with /= r=mjrosenb a=nonlibxul

js/src/ion/MIR.cpp

@@ -786,16 +786,16 @@ MDiv::analyzeEdgeCasesForward()
 
     // Try removing divide by zero check
     if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(0))
-        canBeDivideByZero_ =  false;
+        canBeDivideByZero_ = false;
 
     // If lhs is a constant int != INT32_MIN, then
     // negative overflow check can be skipped.
     if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(INT32_MIN))
-        setCanBeNegativeZero(false);
+        canBeNegativeOverflow_ = false;
 
     // If rhs is a constant int != -1, likewise.
     if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(-1))
-        setCanBeNegativeZero(false);
+        canBeNegativeOverflow_ = false;
 
     // If lhs is != 0, then negative zero check can be skipped.
     if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(0))

js/src/jit-test/tests/ion/bug831087.js

@@ -0,0 +1,15 @@
+function isNegZero(x) {
+  return x===0 && (1/x)===-Infinity;
+}
+
+try {
+    for (y = 0; y < 1; y++) {
+        x = y;
+    }
+} catch (e) {}
+
+function f() {
+    (x /= -9)
+}
+f()
+assertEq(isNegZero(this.x), true);