Add in two patches that were lost while rebasing (bug 765119, r=jandem)

js/src/ion/MIR.h

@@ -2486,7 +2486,7 @@ class MMul : public MBinaryArithInstruction
     }
 
     bool canBeNegativeZero() {
-        if (range()->lower() >= 0 && range()->upper() >= 0)
+        if (range()->lower() > 0 || range()->upper() < 0)
             return false;
         return canBeNegativeZero_;
     }
@@ -2589,11 +2589,16 @@ class MMod : public MBinaryArithInstruction
     bool recomputeRange() {
         if (specialization() != MIRType_Int32)
             return false;
-        Range *other = getOperand(0)->range();
+        Range *rhs = getOperand(1)->range();
-        int64_t a = Range::abs64((int64_t)other->lower());
+        int64_t a = Range::abs64((int64_t)rhs->lower());
-        int64_t b = Range::abs64((int64_t)other->upper());
+        int64_t b = Range::abs64((int64_t)rhs->upper());
-        Range r(Min(-a+1, -b+1),
+        if (a ==0 && b == 0) {
-                Max( a-1,  b-1));
+            // We should never take something % 0.
+            Range r(INT_MIN, INT_MAX);
+            return range()->update(r);
+        }
+        int64_t bound = Max(1-a, b-1);
+        Range r(-bound, bound);
         return range()->update(r);
     }
 };

js/src/ion/RangeAnalysis.cpp

@@ -272,8 +272,10 @@ Range::intersect(const Range *lhs, const Range *rhs, bool *nullRange)
     //
     // Instead, we should use it to eliminate the dead block.
     // (Bug 765127)
-    if (r.upper_ < r.lower_)
+    if (r.upper_ < r.lower_) {
+        *nullRange = true;
         r.makeRangeInfinite();
+    }
     return r;
 }