Add in two patches that were lost while rebasing (bug 765119, r=jandem)
☠☠ backed out by 809b60046c5b ☠ ☠
authorMarty Rosenberg <mrosenberg@mozilla.com>
Wed, 03 Oct 2012 09:37:50 -0400
changeset 109173 1d2a2a4ce97ca310f837e47eb625146962178b10
parent 109172 1a3d23311a58715acdc66860c609f03e69464a0a
child 109174 c63d0cd4603d6455f282a2578d72a8749f737710
push id82
push usershu@rfrn.org
push dateFri, 05 Oct 2012 13:20:22 +0000
reviewersjandem
bugs765119
milestone18.0a1
Add in two patches that were lost while rebasing (bug 765119, r=jandem)
js/src/ion/MIR.h
js/src/ion/RangeAnalysis.cpp
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -2481,17 +2481,17 @@ class MMul : public MBinaryArithInstruct
         return 1;
     }
 
     bool canOverflow() {
         return !range()->isFinite();
     }
 
     bool canBeNegativeZero() {
-        if (range()->lower() >= 0 && range()->upper() >= 0)
+        if (range()->lower() > 0 || range()->upper() < 0)
             return false;
         return canBeNegativeZero_;
     }
     bool updateForReplacement(MDefinition *ins);
 
     bool fallible() {
         return canBeNegativeZero_ || canOverflow();
     }
@@ -2584,21 +2584,26 @@ class MMod : public MBinaryArithInstruct
     double getIdentity() {
         JS_NOT_REACHED("not used");
         return 1;
     }
 
     bool recomputeRange() {
         if (specialization() != MIRType_Int32)
             return false;
-        Range *other = getOperand(0)->range();
-        int64_t a = Range::abs64((int64_t)other->lower());
-        int64_t b = Range::abs64((int64_t)other->upper());
-        Range r(Min(-a+1, -b+1),
-                Max( a-1,  b-1));
+        Range *rhs = getOperand(1)->range();
+        int64_t a = Range::abs64((int64_t)rhs->lower());
+        int64_t b = Range::abs64((int64_t)rhs->upper());
+        if (a ==0 && b == 0) {
+            // We should never take something % 0.
+            Range r(INT_MIN, INT_MAX);
+            return range()->update(r);
+        }
+        int64_t bound = Max(1-a, b-1);
+        Range r(-bound, bound);
         return range()->update(r);
     }
 };
 
 class MConcat
   : public MBinaryInstruction,
     public BinaryStringPolicy
 {
--- a/js/src/ion/RangeAnalysis.cpp
+++ b/js/src/ion/RangeAnalysis.cpp
@@ -267,18 +267,20 @@ Range::intersect(const Range *lhs, const
     //   }
     // }
     //
     // In this case, the block is dead. Right now, we just disregard this fact
     // and make the range infinite, rather than empty.
     //
     // Instead, we should use it to eliminate the dead block.
     // (Bug 765127)
-    if (r.upper_ < r.lower_)
+    if (r.upper_ < r.lower_) {
+        *nullRange = true;
         r.makeRangeInfinite();
+    }
     return r;
 }
 
 void
 Range::unionWith(const Range *other)
 {
    setLower(Min(lower_, other->lower_));
    lower_infinite_ |= other->lower_infinite_;