diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/ion/range-analysis.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/ion/range-analysis.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,35 @@
+// |jit-test|
+
+// Only fails with Ion.
+function add_xors_1() {
+    var res = 0;
+    var step = 4;
+    for (var i = 0x7fffffff | 0; i >= (1 << step); i -= (i >> step)) {
+        var x = i ^ (i << 1);
+        res += (((x + x) + res + res) | 0);
+    }
+    return res;
+}
+
+var r1 = add_xors_1();
+for (var i = 0; i < 100; i++) {
+    var r2 = add_xors_1();
+    assertEq(r2, r1);
+}
+
+// Only fails with JM
+function add_xors_2() {
+    var res = 0;
+    var step = 4;
+    for (var i = 0x7fffffff | 0; i >= (1 << step); i -= (i >> step)) {
+        var x = i ^ (i << 1);
+        res += ((x + x) + res + res) | 0;
+    }
+    return res;
+}
+
+var r1 = add_xors_2();
+for (var i = 0; i < 100; i++) {
+    var r2 = add_xors_2();
+    assertEq(r1, r2);
+}