Constant fold additions to avoid erroneous isPromoteInt detection (bug 465249, r=gal).

js/src/jstracer.cpp

@@ -690,9 +690,23 @@ public:
             if (isPromoteInt(s0) && isPromoteInt(s1)) {
                 // demote fop to op
                 v = (LOpcode)((int)v & ~LIR64);
-                LIns* d0;
-                LIns* d1;
-                LIns* result = out->ins2(v, d0 = demote(out, s0), d1 = demote(out, s1));
+                LIns* d0 = demote(out, s0);
+                LIns* d1 = demote(out, s1);
+                if (d0->isconst() && d1->isconst()) {
+                    int i0 = d0->constval();
+                    int i1 = d1->constval();
+                    if (v == LIR_fsub)
+                        i1 = -i1;
+                    int ir = i0 + i1;
+                    /* If these overflow safely, emit an integer constant. */
+                    if (!(i0 > 0 && i1 > 0 && ir < 0) && !(i0 < 0 && i1 < 0 && ir > 0))
+                        return out->ins1(LIR_i2f, out->insImm(ir));
+                    /* Otherwise, emit a double constant. */
+                    jsdpun u;
+                    u.d = (double)i0 + (double)i1;
+                    return out->insImmq(u.u64);
+                }
+                LIns* result = out->ins2(v, d0, d1);
                 if (!overflowSafe(d0) || !overflowSafe(d1)) {
                     out->insGuard(LIR_xt, out->ins1(LIR_ov, result),
                                   recorder.snapshot(OVERFLOW_EXIT));