JIT affects truthiness of "" <= null (465234, r=Waldo).

js/src/jstracer.cpp

@@ -4464,9 +4464,10 @@ TraceRecorder::cmp(LOpcode op, int flags)
         // The following cases always produce a constant false (or true if negated):
         // - comparing a string against null
         // - comparing a string against any boolean (including undefined)
-        if ((JSVAL_IS_NULL(l) && l_ins->isconst()) ||
-            (JSVAL_IS_NULL(r) && r_ins->isconst()) ||
-            (JSVAL_TAG(l) == JSVAL_BOOLEAN || JSVAL_TAG(r) == JSVAL_BOOLEAN)) {
+        if (op == LIR_feq &&
+            ((JSVAL_IS_NULL(l) && l_ins->isconst()) ||
+             (JSVAL_IS_NULL(r) && r_ins->isconst()) ||
+             (JSVAL_TAG(l) == JSVAL_BOOLEAN || JSVAL_TAG(r) == JSVAL_BOOLEAN))) {
             x = INS_CONST(negate);
             cond = negate;
         } else {

js/src/trace-test.js

@@ -2405,12 +2405,21 @@ test(testBoxDoubleWithDoubleSizedInt);
 function testObjectOrderedCmp()
 {
   var a = new Array(5);
-  for(i=0;i<5;++i) a[i] = ({} < {});
+  for(var i=0;i<5;++i) a[i] = ({} < {});
   return a.join(",");
 }
 testObjectOrderedCmp.expected = "false,false,false,false,false";
 test(testObjectOrderedCmp);
 
+function testObjectOrderedCmp2()
+{
+  var a = new Array(5);
+  for(var i=0;i<5;++i) a[i] = ("" <= null);
+  return a.join(",");
+}
+testObjectOrderedCmp2.expected = "true,true,true,true,true";
+test(testObjectOrderedCmp2);
+
 /* NOTE: Keep this test last, since it screws up all for...in loops after it. */
 function testGlobalProtoAccess() {
     return "ok";