Another assert found while reducing a modified SS fannkuch. Blocking bug 724444 to avoid duplicates.
Created attachment 594695 [details] [diff] [review] Patch If a binary op has int32 result type but one of its operands is |undefined|, we don't want to specialize as int32 since ToNumber(undefined) is NaN. The result will likely be a double (NaN) anyway so just let the stub trigger invalidation. The alternative is to accept only int32 or double types, but I'd rather not do that: (poorly written) benchmarks/scripts may use int32 + bool or something and ToInt32 can handle that just fine.