Don't constant fold operation if result is incompatible with it.

runtime/vm/intermediate_language.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/intermediate_language.h"
 
 #include "vm/bit_vector.h"
 #include "vm/constant_propagator.h"
 #include "vm/cpu.h"
 #include "vm/dart_entry.h"
@@ skipping 1548 matching lines @@
   op->set_can_overflow(can_overflow);
   if (is_truncating) {
     op->mark_truncating();
   }
 
   ASSERT(op->representation() == representation);
   return op;
 }
 
 
+static bool IsRepresentable(const Integer& value, Representation rep) {
+  switch (rep) {
+    case kTagged:  // Smi case.
+      return value.IsSmi();
+
+    case kUnboxedInt32:
+      if (value.IsSmi() || value.IsMint()) {
+        return Utils::IsInt(32, value.AsInt64Value());
+      }
+      return false;
+
+    case kUnboxedMint:
+      return value.IsSmi() || value.IsMint();
+
+    case kUnboxedUint32:  // Only truncating Uint32 arithmetic is supported.
+    default:
+      UNREACHABLE();
+  }
+
+  return false;
+}
+
+
 RawInteger* BinaryIntegerOpInstr::Evaluate(const Integer& left,
                                            const Integer& right) const {
   Integer& result = Integer::Handle();
 
   switch (op_kind()) {
     case Token::kTRUNCDIV:
     case Token::kMOD:
       // Check right value for zero.
       if (right.AsInt64Value() == 0) {
         break;  // Will throw.
@@ skipping 21 matching lines @@
       break;
     default:
       UNREACHABLE();
   }
 
   if (!result.IsNull()) {
     if (is_truncating()) {
       int64_t truncated = result.AsTruncatedInt64Value();
       truncated &= RepresentationMask(representation());
       result = Integer::New(truncated);
+      ASSERT(IsRepresentable(result, representation()));
+    } else if (!IsRepresentable(result, representation())) {
+      // If this operation is not truncating it would deoptimize on overflow.
+      // Check that we match this behavior and don't produce a value that is
+      // larger than something this operation can produce. We could have
+      // specialized instructions that use this value under this assumption.
+      return Integer::null();
     }
     result ^= result.CheckAndCanonicalize(NULL);
   }
 
   return result.raw();
 }
 
 
 Definition* BinaryIntegerOpInstr::Canonicalize(FlowGraph* flow_graph) {
   // If both operands are constants evaluate this expression. Might
@@ skipping 1870 matching lines @@
     case Token::kTRUNCDIV: return 0;
     case Token::kMOD: return 1;
     default: UNIMPLEMENTED(); return -1;
   }
 }
 
 
 #undef __
 
 }  // namespace dart