From aa354bfb9338093a130e9b087fbaa89c09e9bcee Mon Sep 17 00:00:00 2001
From: Nhat Nguyen <t-nhng@microsoft.com>
Date: Thu, 20 Sep 2018 15:57:24 -0700
Subject: [PATCH 1/3] Only do float type specialization if both sources are
 number

---
 lib/Backend/GlobOpt.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/Backend/GlobOpt.cpp b/lib/Backend/GlobOpt.cpp
index de6ba649b82..5eba4527445 100644
--- a/lib/Backend/GlobOpt.cpp
+++ b/lib/Backend/GlobOpt.cpp
@@ -10648,6 +10648,11 @@ GlobOpt::TypeSpecializeFloatBinary(IR::Instr *instr, Value *src1Val, Value *src2
         case Js::OpCode::CmGe_A:
         case Js::OpCode::CmGt_A:
         {
+            if (src1Val->GetValueInfo()->IsNotNumber() || src2Val->GetValueInfo()->IsNotNumber())
+            {
+                return false;
+            }
+
             convertDstToBool = true;
             break;
         }

From e6bf150a768f3036d715482574057161fd4b7d79 Mon Sep 17 00:00:00 2001
From: Nhat Nguyen <t-nhng@microsoft.com>
Date: Thu, 20 Sep 2018 16:52:12 -0700
Subject: [PATCH 2/3] Add bug test case

---
 test/Basics/FloatComparison.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/test/Basics/FloatComparison.js b/test/Basics/FloatComparison.js
index ef238351341..5df809bf7ef 100644
--- a/test/Basics/FloatComparison.js
+++ b/test/Basics/FloatComparison.js
@@ -63,6 +63,23 @@ var tests = [
             assert.isFalse({} < 0.5);
             assert.isFalse({} <= 0.5);
         }
+    },
+    {
+        name: "bug file from ExprGen",
+        body: function() {
+            function test0() {
+                var func2 = function () {
+                  return f32[1];
+                };
+                var f32 = new Float32Array();
+                var f = 100;
+                for (let i = 0; i < f; i++) {
+                    var id41 = 'caller';
+                    ({ 18: func2() === 'caller' });
+                }
+            }
+            test0();
+        }
     }
 ];
 

From 1c3ea7eb21b261848b8aeb6e15c1678468730128 Mon Sep 17 00:00:00 2001
From: Nhat Nguyen <t-nhng@microsoft.com>
Date: Fri, 21 Sep 2018 09:22:17 -0700
Subject: [PATCH 3/3] More descriptive name for test

---
 test/Basics/FloatComparison.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/Basics/FloatComparison.js b/test/Basics/FloatComparison.js
index 5df809bf7ef..c12511c50fc 100644
--- a/test/Basics/FloatComparison.js
+++ b/test/Basics/FloatComparison.js
@@ -65,7 +65,7 @@ var tests = [
         }
     },
     {
-        name: "bug file from ExprGen",
+        name: "No float type specialization when operands are not number",
         body: function() {
             function test0() {
                 var func2 = function () {