Fix bug in the count operation where we statically know the input is a smi.

src/data-flow.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1099 matching lines @@
   }
 
   // The direction of the count operation must agree with the start and the end
   // value. We currently do not allow the initial value to be the same as the
   // terminal value. This _would_ be ok as long as the loop body never executes
   // or executes exactly one time.
   if (init_value == term_value) return NULL;
   if (init_value < term_value && update->op() != Token::INC) return NULL;
   if (init_value > term_value && update->op() != Token::DEC) return NULL;
 
+  // Check that the update operation cannot overflow the smi range. This can
+  // occur in the two cases where the loop bound is equal to the largest or
+  // smallest smi.
+  if (update->op() == Token::INC && term_value == Smi::kMaxValue) return NULL;
+  if (update->op() == Token::DEC && term_value == Smi::kMinValue) return NULL;
+
   // Found a smi loop variable.
   return loop_var;
 }
 
 int AssignedVariablesAnalyzer::BitIndex(Variable* var) {
   ASSERT(var != NULL);
   ASSERT(var->IsStackAllocated());
   Slot* slot = var->slot();
   if (slot->type() == Slot::PARAMETER) {
     return slot->index();
@@ skipping 1069 matching lines @@
 
   // Step 4: Based on RD_in for block nodes, propagate reaching definitions
   // to all variable uses in the block.
   for (int i = 0; i < node_count; i++) {
     postorder_->at(i)->PropagateReachingDefinitions(&variables_);
   }
 }
 
 
 } }  // namespace v8::internal