Bug 925586 - IonMonkey: Extend range checking to all values with numeric and numeric-like types. r=nbp

js/src/jit/Lowering.cpp

@@ -2706,6 +2706,7 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
     LInstruction *lir = nullptr;
 
     switch (input->type()) {
+      case MIRType_Boolean:
       case MIRType_Int32:
         lir = new LAssertRangeI(useRegisterAtStart(input));
         break;

js/src/jit/RangeAnalysis.cpp

@@ -1845,14 +1845,25 @@ RangeAnalysis::addRangeAssertions()
         for (MInstructionIterator iter(block->begin()); iter != block->end(); iter++) {
             MInstruction *ins = *iter;
 
-            if (ins->type() == MIRType_None)
+            // Perform range checking for all numeric and numeric-like types.
+            if (!IsNumberType(ins->type()) &&
+                ins->type() != MIRType_Boolean &&
+                ins->type() != MIRType_Value)
+            {
+                continue;
+            }
+
+            Range r(ins);
+
+            // Don't insert assertions if there's nothing interesting to assert.
+            if (r.isUnknown() || (ins->type() == MIRType_Int32 && r.isUnknownInt32()))
                 continue;
 
-            Range *r = ins->range();
-            if (!r)
+            // Range-checking PassArgs breaks stuff.
+            if (ins->isPassArg())
                 continue;
 
-            MAssertRange *guard = MAssertRange::New(ins, new Range(*r));
+            MAssertRange *guard = MAssertRange::New(ins, new Range(r));
 
             // The code that removes beta nodes assumes that it can find them
             // in a contiguous run at the top of each block. Don't insert

js/src/jit/RangeAnalysis.h

@@ -359,6 +359,17 @@ class Range : public TempObject {
 
     static bool negativeZeroMul(const Range *lhs, const Range *rhs);
 
+    bool isUnknownInt32() const {
+        return isInt32() && lower() == INT32_MIN && upper() == INT32_MAX;
+    }
+
+    bool isUnknown() const {
+        return !hasInt32LowerBound_ &&
+               !hasInt32UpperBound_ &&
+               canHaveFractionalPart_ &&
+               max_exponent_ == IncludesInfinityAndNaN;
+    }
+
     bool hasInt32LowerBound() const {
         return hasInt32LowerBound_;
     }