Bug 892291: Correctly compute ranges for Math.imul; r=nbp

--HG--
extra : rebase_source : 0b6d8d27bbb01fee911e90fc571f683e175fdbbc

js/src/ion/RangeAnalysis.cpp

@@ -940,6 +940,10 @@ MMul::computeRange()
     if (canBeNegativeZero())
         canBeNegativeZero_ = Range::negativeZeroMul(&left, &right);
     setRange(Range::mul(&left, &right));
+
+    // Truncated multiplications could overflow in both directions
+    if (isTruncated() && !range()->isInt32())
+        setRange(new Range(INT32_MIN, INT32_MAX));
 }
 
 void

js/src/jit-test/tests/asm.js/testBug892291.js

@@ -0,0 +1,10 @@
+function a(stdlib) {
+  "use asm";
+  var imul = stdlib.Math.imul;
+  function f() {
+    return ((imul(-800, 0xf8ba1243)|0) % -1)|0;
+  }
+  return f;
+}
+var f = a(this);
+assertEq(f(), 0);