--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -3414,16 +3414,17 @@ TraceRecorder::cmp(LOpcode op, int flags
         if (op != LIR_eq && (JSVAL_TAG(l) == JSVAL_BOOLEAN) && (JSVAL_TAG(r) == JSVAL_BOOLEAN)) {
             x = lir->ins_choose(lir->ins2i(LIR_eq, 
                                            lir->ins2i(LIR_and, 
                                                       lir->ins2(LIR_or, l_ins, r_ins),
                                                       JSVAL_TO_BOOLEAN(JSVAL_VOID)),
                                            JSVAL_TO_BOOLEAN(JSVAL_VOID)),
                                 lir->insImm(JSVAL_TO_BOOLEAN(JSVAL_FALSE)),
                                 x);
+            x = lir->ins_eq0(lir->ins_eq0(x));
             if ((l == JSVAL_VOID) || (r == JSVAL_VOID))
                 cond = false;
         }
     }
     
     /* Don't guard if the same path is always taken. */
     if (!x->isconst()) {
         if (flags & CMP_CASE) {

--- a/js/src/trace-test.js
+++ b/js/src/trace-test.js
@@ -2066,11 +2066,19 @@ function testResumeOp() {
     var x = "";
     while (a.length > 0)
         x += a.pop();
     return x;
 }
 testResumeOp.expected = "16151413121110987654321";
 test(testResumeOp);
 
+function testUndefinedCmp() {
+    var a = false;
+    for (var j = 0; j < 4; ++j) { if (undefined < false) { a = true; } }
+    return a;
+}
+testUndefinedCmp.expected = false;
+test(testUndefinedCmp);
+
 /* Keep these at the end so that we can see the summary after the trace-debug spew. */
 print("\npassed:", passes.length && passes.join(","));
 print("\nFAILED:", fails.length && fails.join(","));