The bisection seems to be wrong. This is actually a regression from bug 1176230. [This code](https://searchfox.org/mozilla-central/rev/b94f0c157227dadd3ecf119ce271035c52ed237b/js/src/jit/MIR.cpp#2056-2063) replaces the pattern `testArg ? testArg : 0.0` with `MNaNToZero`. But that is incorrect when `testArg` is `-0`, because then `-0` isn't normalised to `+0`.
Bug 1790647 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
~~The bisection seems to be wrong. This is actually a regression from bug 1176230.~~ (Scratch that, bug 1783622 also changed the recover code for `MNaNToZero`.) [This code](https://searchfox.org/mozilla-central/rev/b94f0c157227dadd3ecf119ce271035c52ed237b/js/src/jit/MIR.cpp#2056-2063) replaces the pattern `testArg ? testArg : 0.0` with `MNaNToZero`. But that is incorrect when `testArg` is `-0`, because then `-0` isn't normalised to `+0`.