changeset: 143171:50fded5df4fd
authorDan Gohman <sunfish@google.com>
Mon, 19 Aug 2013 17:04:09 -0700
changeset 143174 86074c80a35a73f94a0fcdfca5a171d81b6c822f
parent 143173 a08feefbb8c3bc926d4fe1ea169cda11b564ed8b
child 143175 f6d8cd174ec927fce5f1e1f716e78ca1303127bc
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
bugs143171, 906885
milestone26.0a1
changeset: 143171:50fded5df4fd tag: tip user: Dan Gohman <sunfish@google.com> summary: Bug 906885 - IonMonkey: Don't use range::isInfinite to test whether the value can be outside the bounds implied by lower() and upper(). r=nbp
js/src/jit-test/tests/ion/bug906885.js
js/src/jit/RangeAnalysis.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug906885.js
@@ -0,0 +1,5 @@
+ParallelArray([57], function() {
+    return (Math.max(2207764374, (function() {
+        return 1
+    })()))
+})
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -690,31 +690,31 @@ Range::abs(const Range *op)
                      Max(Abs(l), Abs(u)),
                      op->isDecimal(),
                      op->exponent());
 }
 
 Range *
 Range::min(const Range *lhs, const Range *rhs)
 {
-    // If either operand is NaN (implied by isInfinite here), the result is NaN.
-    if (lhs->isInfinite() || rhs->isInfinite())
+    // If either operand is NaN, the result is NaN.
+    if (!lhs->isInt32() || !rhs->isInt32())
         return new Range();
 
     return new Range(Min(lhs->lower(), rhs->lower()),
                      Min(lhs->upper(), rhs->upper()),
                      lhs->isDecimal() || rhs->isDecimal(),
                      Max(lhs->exponent(), rhs->exponent()));
 }
 
 Range *
 Range::max(const Range *lhs, const Range *rhs)
 {
-    // If either operand is NaN (implied by isInfinite here), the result is NaN.
-    if (lhs->isInfinite() || rhs->isInfinite())
+    // If either operand is NaN, the result is NaN.
+    if (!lhs->isInt32() || !rhs->isInt32())
         return new Range();
 
     return new Range(Max(lhs->lower(), rhs->lower()),
                      Max(lhs->upper(), rhs->upper()),
                      lhs->isDecimal() || rhs->isDecimal(),
                      Max(lhs->exponent(), rhs->exponent()));
 }
 
@@ -1056,17 +1056,17 @@ MMod::computeRange()
 {
     if (specialization() != MIRType_Int32 && specialization() != MIRType_Double)
         return;
     Range lhs(getOperand(0));
     Range rhs(getOperand(1));
 
     // If either operand is a NaN, the result is NaN. This also conservatively
     // handles Infinity cases.
-    if (lhs.isInfinite() || rhs.isInfinite())
+    if (!lhs.isInt32() || !rhs.isInt32())
         return;
 
     // If RHS can be zero, the result can be NaN.
     if (rhs.lower() <= 0 && rhs.upper() >= 0)
         return;
 
     // Math.abs(lhs % rhs) == Math.abs(lhs) % Math.abs(rhs).
     // First, the absolute value of the result will always be less than the