cloop overflow test is broken in recent clang

• Component: JavaScriptCore
• Status: NEW ---

[Richard O'Grady]

cloop.rb's cloopAddOverflowTest() uses this check: "((#{signBit}(b) != #{signBit}(a)) && (#{signBit}(b-a) == #{signBit}(a)))" to detect overflow, and similarly for subtraction.

In clang r221045, an optimization was introduced which breaks this for the case where we are incrementing a value by 1.

Repro on Linux (with clang r221045 or above):

$ CC=clang
$ CXX=clang
$ build-jsc --cloop --release --gtk

Then execute this in jsc: 
for (var i = 0x7fffffff; i < 0x80000000; i++) {print(i);}

Notice that i wraps around to become negative.

Using safeAdd() and safeSub() from CheckedArithmetic.h avoids the problem.