Fix buggy computations in value ranges, spotted by floitsch@.

lib/compiler/implementation/ssa/value_range_analyzer.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 /**
  * A [Value] represents both symbolic values like the value of a
  * parameter, or the length of an array, and concrete values, like
  * constants.
  */
 abstract class Value {
@@ skipping 34 matching lines @@
 class IntValue extends Value {
   final int value;
   const IntValue(this.value);
 
   Value operator +(other) {
     if (other is !IntValue) return other + this;
     return new IntValue(value + other.value);
   }
 
   Value operator -(other) {
-    if (other is !IntValue) return other - this;
+    if (other is !IntValue) {
+      return new OperationValue(this, other, const SubtractOperation());

[floitsch, 2012/10/10 15:19:59]

you shouldn't use the operations directly but fetch them from the correct
system.

[ngeoffray, 2012/10/15 12:17:23]

I removed this code, so it's not a problem anymore.

+    }
     return new IntValue(value - other.value);
   }
 
   Value operator &(other) {
-    if (other is !IntValue) return this;
+    if (other is !IntValue) {
+      if (isPositive()) return this;
+      if (other.isPositive()) return new IntValue(-value);

[floitsch, 2012/10/10 15:19:59]

I don't think this is true.
-1 & FF => FF and not 1

[ngeoffray, 2012/10/15 12:17:23]

Well spotted. Actually I think this is dead code, let me check and update the
code.

+      return const UnknownValue();
+    }
     return new IntValue(value & other.value);
   }
 
   Value min(other) {
     if (other is !IntValue) return other.min(this);
     return this.value < other.value ? this : other;
   }
 
   Value max(other) {
     if (other is !IntValue) return other.max(this);
@@ skipping 208 matching lines @@
       else up = upper;
     }
     return new Range(low, up);
   }
 
   Range operator +(Range other) {
     return new Range.normalize(lower + other.lower, upper + other.upper);
   }
 
   Range operator -(Range other) {
-    return new Range.normalize(lower - other.lower, upper - other.upper);
+    return new Range.normalize(lower - other.upper, upper - other.lower);
   }
 
   Range operator &(Range other) {
-    return new Range.normalize(lower & other.lower, upper & other.upper);
+    if (isSingleValue()
+        && other.isSingleValue()
+        && lower is IntValue
+        && other.lower is IntValue) {
+      return new Range(lower & other.lower, upper & other.upper);
+    }
+    if (isPositive() && other.isPositive()) {
+      Value up = upper.min(other.upper);
+      if (up == const UnknownValue()) {
+        // If we could not find a trivial bound, just try to use the
+        // one that is an int.
+        up = upper is IntValue ? upper : other.upper;
+        // Make sure we get the same upper bound, whether it's a & b
+        // or b & a.
+        if (up is! IntValue && upper != other.upper) up = const MaxIntValue();
+      }
+      return new Range(const IntValue(0), up);
+    } else if (isPositive()) {
+      return new Range(const IntValue(0), upper);
+    } else if (other.isPositive()) {
+      return new Range(const IntValue(0), other.upper);
+    } else {
+      return const Range.unbound();
+    }
   }
 
   bool operator ==(other) {
     if (other is! Range) return false;
     return other.lower == lower && other.upper == upper;
   }
 
   bool operator <(Range other) {
     return upper != other.lower && upper.min(other.lower) == upper;
   }
@@ skipping 470 matching lines @@
     if (instruction is HPhi && !instruction.block.isLoopHeader()) {
       HInstruction result = unwrap(instruction.inputs[0]);
       for (int i = 1; i < instruction.inputs.length; i++) {
         if (result != unwrap(instruction.inputs[i])) return instruction;
       }
       return result;
     }
     return instruction;
   }
 }