Bug 950438 - IonMonkey: The intersection of two ranges that both contain NaN is not empty. r=nbp

js/src/jit/RangeAnalysis.cpp

@@ -413,7 +413,9 @@ Range::intersect(TempAllocator &alloc, const Range *lhs, const Range *rhs, bool
     // Instead, we should use it to eliminate the dead block.
     // (Bug 765127)
     if (newUpper < newLower) {
-        *emptyRange = true;
+        // If both ranges can be NaN, the result can still be NaN.
+        if (!lhs->canBeNaN() || !rhs->canBeNaN())
+            *emptyRange = true;
         return nullptr;
     }