From 7bdb656ede93e236b2faca68b2482816bba43bd1 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Fri, 31 Oct 2014 13:21:12 +0100
Subject: [PATCH] Bug 1090424: IonMonkey: Improve range on when to fold
 MCompare, r=sunfish

---
 js/src/jit-test/tests/ion/bug1090424.js | 55 +++++++++++++++++++++++++
 js/src/jit/MIR.cpp                      | 28 +++++++++----
 2 files changed, 76 insertions(+), 7 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1090424.js

diff --git a/js/src/jit-test/tests/ion/bug1090424.js b/js/src/jit-test/tests/ion/bug1090424.js
new file mode 100644
index 00000000000..4fd53fe5dec
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1090424.js
@@ -0,0 +1,55 @@
+
+let w
+(function() {
+ testgt1 = function(x) {
+    return (-0x80000000 >= (x | 0))
+}
+ testgt2 = function(x) {
+    return (+0x7fffffff >= (x | 0))
+}
+ testgt3 = function(x) {
+    return ((x | 0) >= -0x80000000)
+}
+ testgt4 = function(x) {
+    return ((x | 0) >= +0x7fffffff)
+}
+
+ testlt1 = function(x) {
+    return (-0x80000000 <= (x | 0))
+}
+ testlt2 = function(x) {
+    return (+0x7fffffff <= (x | 0))
+}
+ testlt3 = function(x) {
+    return ((x | 0) <= -0x80000000)
+}
+ testlt4 = function(x) {
+    return ((x | 0) <= +0x7fffffff)
+}
+
+})()
+assertEq(testgt1(-0x80000000), true);
+assertEq(testgt1(-0x80000000), true);
+assertEq(testgt1(0), false);
+assertEq(testgt2(0x7fffffff), true);
+assertEq(testgt2(0x7fffffff), true);
+assertEq(testgt2(0), true);
+assertEq(testgt3(-0x80000000), true);
+assertEq(testgt3(-0x80000000), true);
+assertEq(testgt3(0), true);
+assertEq(testgt4(0x7fffffff), true);
+assertEq(testgt4(0x7fffffff), true);
+assertEq(testgt4(0), false);
+
+assertEq(testlt1(-0x80000000), true);
+assertEq(testlt1(-0x80000000), true);
+assertEq(testlt1(0), true);
+assertEq(testlt2(0x7fffffff), true);
+assertEq(testlt2(0x7fffffff), true);
+assertEq(testlt2(0), false);
+assertEq(testlt3(-0x80000000), true);
+assertEq(testlt3(-0x80000000), true);
+assertEq(testlt3(0), false);
+assertEq(testlt4(0x7fffffff), true);
+assertEq(testlt4(0x7fffffff), true);
+assertEq(testlt4(0), true);
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 6023693a889..f72743d6f2f 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -1870,7 +1870,7 @@ MMinMax::foldsTo(TempAllocator &alloc)
         }
 
         // max(int32, cte <= INT32_MIN) = int32
-        if (val.isDouble() && val.toDouble() < INT32_MIN && isMax()) {
+        if (val.isDouble() && val.toDouble() <= INT32_MIN && isMax()) {
             MLimitedTruncate *limit =
                 MLimitedTruncate::New(alloc, operand->getOperand(0), MDefinition::NoTruncate);
             block()->insertBefore(this, limit);
@@ -3059,9 +3059,16 @@ MCompare::evaluateConstantOperands(TempAllocator &alloc, bool *result)
                 }
                 break;
               case JSOP_LE:
-                if (cte >= INT32_MAX || cte <= INT32_MIN) {
-                    *result = !((constant == lhs()) ^ (cte <= INT32_MIN));
-                    replaced = true;
+                if (constant == lhs()) {
+                    if (cte > INT32_MAX || cte <= INT32_MIN) {
+                        *result = (cte <= INT32_MIN);
+                        replaced = true;
+                    }
+                } else {
+                    if (cte >= INT32_MAX || cte < INT32_MIN) {
+                        *result = (cte >= INT32_MIN);
+                        replaced = true;
+                    }
                 }
                 break;
               case JSOP_GT:
@@ -3071,9 +3078,16 @@ MCompare::evaluateConstantOperands(TempAllocator &alloc, bool *result)
                 }
                 break;
               case JSOP_GE:
-                if (cte >= INT32_MAX || cte <= INT32_MIN) {
-                    *result = !((constant == rhs()) ^ (cte <= INT32_MIN));
-                    replaced = true;
+                if (constant == lhs()) {
+                    if (cte >= INT32_MAX || cte < INT32_MIN) {
+                        *result = (cte >= INT32_MAX);
+                        replaced = true;
+                    }
+                } else {
+                    if (cte > INT32_MAX || cte <= INT32_MIN) {
+                        *result = (cte <= INT32_MIN);
+                        replaced = true;
+                    }
                 }
                 break;
               case JSOP_STRICTEQ: // Fall through.