Merge r5793 into 2.3 branch.

src/ia32/codegen-ia32.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 8555 matching lines @@
         } else if (op == Token::SUB) {
           __ sub(left.reg(), Operand(right.reg()));
         } else {
           ASSERT(op == Token::MUL);
           // We have statically verified that a negative zero can be ignored.
           __ imul(left.reg(), Operand(right.reg()));
         }
       }
       right.Unuse();
       frame_->Push(&left);
-      if (!node->to_int32()) {
-        // If ToInt32 is called on the result of ADD, SUB, or MUL, we don't
+      if (!node->to_int32() || op == Token::MUL) {
+        // If ToInt32 is called on the result of ADD, SUB, we don't
         // care about overflows.
+        // Result of MUL can be non-representable precisely in double so
+        // we have to check for overflow.
         unsafe_bailout_->Branch(overflow);
       }
       break;
     case Token::DIV:
     case Token::MOD: {
       if (right.is_register() && (right.reg().is(eax) || right.reg().is(edx))) {
         if (left.is_register() && left.reg().is(edi)) {
           right.ToRegister(ebx);
         } else {
           right.ToRegister(edi);
@@ skipping 1409 matching lines @@
   masm.GetCode(&desc);
   // Call the function from C++.
   return FUNCTION_CAST<MemCopyFunction>(buffer);
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32