Fix uses of range analysis results in HChange.

src/hydrogen-instructions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1655 matching lines @@
 Range* HChange::InferRange(Zone* zone) {
   Range* input_range = value()->range();
   if (from().IsInteger32() && !value()->CheckFlag(HInstruction::kUint32) &&
       (to().IsSmi() ||
        (to().IsTagged() &&
         input_range != NULL &&
         input_range->IsInSmiRange()))) {
     set_type(HType::Smi());
     ClearChangesFlag(kNewSpacePromotion);
   }
+  if (to().IsSmiOrTagged() &&
+      input_range != NULL &&
+      input_range->IsInSmiRange() &&
+      (!SmiValuesAre32Bits() ||
+       !value()->CheckFlag(HValue::kUint32) ||
+       input_range->upper() != kMaxInt)) {
+    // The Range class can't express upper bounds in the (kMaxInt, kMaxUint32]
+    // interval, so we treat kMaxInt as a sentinel for this entire interval.
+    ClearFlag(kCanOverflow);
+  }
   Range* result = (input_range != NULL)
       ? input_range->Copy(zone)
       : HValue::InferRange(zone);
   result->set_can_be_minus_zero(!to().IsSmiOrInteger32() ||
                                 !(CheckFlag(kAllUsesTruncatingToInt32) ||
                                   CheckFlag(kAllUsesTruncatingToSmi)));
   if (to().IsSmi()) result->ClampToSmi();
   return result;
 }
 
@@ skipping 2857 matching lines @@
       break;
     case kExternalMemory:
       stream->Add("[external-memory]");
       break;
   }
 
   stream->Add("@%d", offset());
 }
 
 } }  // namespace v8::internal