diff --git a/js/src/jit-test/tests/asm.js/bug928450.js b/js/src/jit-test/tests/asm.js/bug928450.js new file mode 100644 index 000000000000..172860fa0e7f --- /dev/null +++ b/js/src/jit-test/tests/asm.js/bug928450.js @@ -0,0 +1,6 @@ +(function() { + "use asm" + function f() { + i((1.5 != 2.) ? 3 : 0) + } +})() diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp index 520f7550379a..b5def9a63e2e 100644 --- a/js/src/jit/RangeAnalysis.cpp +++ b/js/src/jit/RangeAnalysis.cpp @@ -389,9 +389,18 @@ Range::intersect(const Range *lhs, const Range *rhs, bool *emptyRange) // of 1.5, it may have a range like [0,2] and the max_exponent may be zero. // When intersecting such a range with an integer range, the fractional part // of the range is dropped, but the max exponent of 0 remains valid. - if (lhs->canHaveFractionalPart_ != rhs->canHaveFractionalPart_) + if (lhs->canHaveFractionalPart_ != rhs->canHaveFractionalPart_) { refineInt32BoundsByExponent(newExponent, &newLower, &newUpper); + // If we're intersecting two ranges that don't overlap, this could also + // push the bounds past each other, since the actual intersection is + // the empty set. + if (newLower > newUpper) { + *emptyRange = true; + return nullptr; + } + } + return new Range(newLower, newHasInt32LowerBound, newUpper, newHasInt32UpperBound, newFractional, newExponent); }