Bug 927389 - IonMonkey: Refine a range's lower and upper bounds when clearing its fractional part. r=nbp

js/src/jit-test/tests/asm.js/bug927389.js

@@ -0,0 +1,6 @@
+(function() {
+    "use asm"
+    function f() {
+        +~~1.1
+    }
+})()

js/src/jit-test/tests/ion/bug927389.js

@@ -0,0 +1,4 @@
+(function () {
+    var x = 0 || 1.1;
+    x >> x;
+})();

js/src/jit/RangeAnalysis.cpp

@@ -389,16 +389,8 @@ Range::intersect(const Range *lhs, const Range *rhs, bool *emptyRange)
     // of 1.5, it may have a range like [0,2] and the max_exponent may be zero.
     // When intersecting such a range with an integer range, the fractional part
     // of the range is dropped, but the max exponent of 0 remains valid.
-    if (lhs->canHaveFractionalPart_ != rhs->canHaveFractionalPart_ &&
-        newExponent < MaxInt32Exponent)
-    {
-        // pow(2, newExponent+1)-1 to compute the maximum value for newExponent.
-        int32_t limit = (uint32_t(1) << (newExponent + 1)) - 1;
-        if (limit != INT32_MIN) {
-            newUpper = Min(newUpper, limit);
-            newLower = Max(newLower, -limit);
-        }
-    }
+    if (lhs->canHaveFractionalPart_ != rhs->canHaveFractionalPart_)
+        refineInt32BoundsByExponent(newExponent, &newLower, &newUpper);
 
     return new Range(newLower, newHasInt32LowerBound, newUpper, newHasInt32UpperBound,
                      newFractional, newExponent);
@@ -1941,10 +1933,17 @@ Range::clampToInt32()
 void
 Range::wrapAroundToInt32()
 {
-    if (!hasInt32Bounds())
+    if (!hasInt32Bounds()) {
         setInt32(JSVAL_INT_MIN, JSVAL_INT_MAX);
-    else if (canHaveFractionalPart())
+    } else if (canHaveFractionalPart()) {
         canHaveFractionalPart_ = false;
+
+        // Clearing the fractional field may provide an opportunity to refine
+        // lower_ or upper_.
+        refineInt32BoundsByExponent(max_exponent_, &lower_, &upper_);
+
+        assertInvariants();
+    }
 }
 
 void

js/src/jit/RangeAnalysis.h

@@ -254,6 +254,24 @@ class Range : public TempObject {
          return result;
     }
 
+    // When converting a range which contains fractional values to a range
+    // containing only integers, the old max_exponent_ value may imply a better
+    // lower and/or upper bound than was previously available, because they no
+    // longer need to be conservative about fractional offsets and the ends of
+    // the range.
+    //
+    // Given an exponent value and pointers to the lower and upper bound values,
+    // this function refines the lower and upper bound values to the tighest
+    // bound for integer values implied by the exponent.
+    static void refineInt32BoundsByExponent(uint16_t e, int32_t *l, int32_t *h) {
+       if (e < MaxInt32Exponent) {
+           // pow(2, max_exponent_+1)-1 to compute a maximum absolute value.
+           int32_t limit = (uint32_t(1) << (e + 1)) - 1;
+           *h = Min(*h, limit);
+           *l = Max(*l, -limit);
+       }
+    }
+
     // If the value of any of the fields implies a stronger possible value for
     // any other field, update that field to the stronger value. The range must
     // be completely valid before and it is guaranteed to be kept valid.