Bug 909494 - IonMonkey: Fix MMod range analysis for non-integer values. r=nbp, a=bajaj
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -1061,17 +1061,23 @@ MMod::computeRange()
// Math.abs(lhs % rhs) == Math.abs(lhs) % Math.abs(rhs).
// First, the absolute value of the result will always be less than the
// absolute value of rhs. (And if rhs is zero, the result is NaN).
int64_t a = Abs<int64_t>(rhs.lower());
int64_t b = Abs<int64_t>(rhs.upper());
if (a == 0 && b == 0)
return;
- int64_t rhsAbsBound = Max(a-1, b-1);
+ int64_t rhsAbsBound = Max(a, b);
+
+ // If the value is known to be integer, less-than abs(rhs) is equivalent
+ // to less-than-or-equal abs(rhs)-1. This is important for being able to
+ // say that the result of x%256 is an 8-bit unsigned number.
+ if (!lhs.isDecimal() && !rhs.isDecimal())
+ --rhsAbsBound;
// Next, the absolute value of the result will never be greater than the
// absolute value of lhs.
int64_t lhsAbsBound = Max(Abs<int64_t>(lhs.lower()), Abs<int64_t>(lhs.upper()));
// This gives us two upper bounds, so we can take the best one.
int64_t absBound = Min(lhsAbsBound, rhsAbsBound);