[JSC] Fix IntRange speculation for zExt32

https://bugs.webkit.org/show_bug.cgi?id=256573
rdar://109134454

Reviewed by Yusuke Suzuki.

Previously, the IntRange speculation in B3ReduceStrength for node
zExt32 is wrong. This patch fixes this issue.

* JSTests/stress/regress-109134454.js: Added.
* Source/JavaScriptCore/b3/B3ReduceStrength.cpp:

Originally-landed-as: 259548.761@safari-7615-branch (7760669). rdar://109134454
Canonical link: https://commits.webkit.org/266443@main

JSTests/stress/regress-109134454.js

@@ -0,0 +1,14 @@
+//@ runDefault("--useConcurrentJIT=0", "--forceWeakRandomSeed=1", "--jitPolicyScale=0")
+
+for (let i = 0; i < 8; i++) {
+    for (let j = 0; j < 8; j++) {
+        const t1 = j + 2147483649;
+        const t2 = (2147483649 >>> (t1 & i)) - 2147483649;
+        const t3 = t2 * t1;
+        const t4 = t2 + t3;
+        if (i == 3 && j === 0) {
+            if (t3 !== -2305843012434919400)
+                throw new Error("bad");
+        }
+    }
+}

Source/JavaScriptCore/b3/B3ReduceStrength.cpp

@@ -108,6 +108,7 @@ class IntRange {
         : m_min(min)
         , m_max(max)
     {
+        ASSERT(m_min <= m_max);
     }
 
     template<typename T>
@@ -456,9 +457,15 @@ class IntRange {
     {
         ASSERT(m_min >= INT32_MIN);
         ASSERT(m_max <= INT32_MAX);
-        int32_t min = m_min;
-        int32_t max = m_max;
-        return IntRange(static_cast<uint64_t>(static_cast<uint32_t>(min)), static_cast<uint64_t>(static_cast<uint32_t>(max)));
+        uint64_t min = static_cast<uint64_t>(static_cast<uint32_t>(m_min));
+        uint64_t max = static_cast<uint64_t>(static_cast<uint32_t>(m_max));
+        if (m_max < 0 || m_min >= 0) {
+            // m_min = -2, m_max = -1 then should return [0xFFFF_FFFE, 0xFFFF_FFFF]
+            // m_min =  1, m_max =  2 then should return [1, 2]
+            return IntRange(min, max);
+        }
+        // m_min = a negative integer, m_max >= 0 then should return [0, 0xFFFF_FFFF]
+        return IntRange(0, std::numeric_limits<uint32_t>::max());
     }
 
 private: