Bug 894813 - IonMonkey: Avoid temporary invalidity in Range::intersect, and re-enable the Range constructor asserts. r=nbp

js/src/jit/RangeAnalysis.cpp

@@ -316,14 +316,8 @@ Range::intersect(const Range *lhs, const Range *rhs, bool *emptyRange)
     if (!rhs)
         return new Range(*lhs);
 
-    Range *r = new Range(
-        Max(lhs->lower_, rhs->lower_),
-        Min(lhs->upper_, rhs->upper_),
-        lhs->decimal_ && rhs->decimal_,
-        Min(lhs->max_exponent_, rhs->max_exponent_));
-
-    r->lower_infinite_ = lhs->lower_infinite_ && rhs->lower_infinite_;
-    r->upper_infinite_ = lhs->upper_infinite_ && rhs->upper_infinite_;
+    int32_t newLower = Max(lhs->lower_, rhs->lower_);
+    int32_t newUpper = Min(lhs->upper_, rhs->upper_);
 
     // :TODO: This information could be used better. If upper < lower, then we
     // have conflicting constraints. Consider:
@@ -339,11 +333,19 @@ Range::intersect(const Range *lhs, const Range *rhs, bool *emptyRange)
     //
     // Instead, we should use it to eliminate the dead block.
     // (Bug 765127)
-    if (r->upper_ < r->lower_) {
+    if (newUpper < newLower) {
         *emptyRange = true;
-        r->makeRangeInfinite();
+        return NULL;
     }
 
+    Range *r = new Range(
+        newLower, newUpper,
+        lhs->decimal_ && rhs->decimal_,
+        Min(lhs->max_exponent_, rhs->max_exponent_));
+
+    r->lower_infinite_ = lhs->lower_infinite_ && rhs->lower_infinite_;
+    r->upper_infinite_ = lhs->upper_infinite_ && rhs->upper_infinite_;
+
     return r;
 }
 

js/src/jit/RangeAnalysis.h

@@ -174,6 +174,9 @@ class Range : public TempObject {
           symbolicLower_(NULL),
           symbolicUpper_(NULL)
     {
+        JS_ASSERT(e >= (h == INT64_MIN ? MaxDoubleExponent : mozilla::FloorLog2(mozilla::Abs(h))));
+        JS_ASSERT(e >= (l == INT64_MIN ? MaxDoubleExponent : mozilla::FloorLog2(mozilla::Abs(l))));
+
         setLowerInit(l);
         setUpperInit(h);
         rectifyExponent();