1 files changed, 12 insertions, 19 deletions
diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
index 75ab8fcb29..8f17ff15ca 100644
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -13,6 +13,7 @@
 #include "mozilla/MathAlgorithms.h"
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/Unused.h"
+#include "mozilla/WrappingOperations.h"
 
 #include <algorithm>  // for std::max
 #include <fcntl.h>
@@ -103,6 +104,7 @@ using mozilla::IsNegative;
 using mozilla::IsNegativeZero;
 using mozilla::PositiveInfinity;
 using mozilla::NegativeInfinity;
+using mozilla::WrappingMultiply;
 using JS::ToNumber;
 using JS::GenericNaN;
 
@@ -458,16 +460,13 @@ js::math_floor(JSContext* cx, unsigned argc, Value* vp)
 bool
 js::math_imul_handle(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
 {
-    uint32_t a = 0, b = 0;
-    if (!lhs.isUndefined() && !ToUint32(cx, lhs, &a))
+    int32_t a = 0, b = 0;
+    if (!lhs.isUndefined() && !ToInt32(cx, lhs, &a))
         return false;
-    if (!rhs.isUndefined() && !ToUint32(cx, rhs, &b))
+    if (!rhs.isUndefined() && !ToInt32(cx, rhs, &b))
         return false;
 
-    uint32_t product = a * b;
-    res.setInt32(product > INT32_MAX
-                 ? int32_t(INT32_MIN + (product - INT32_MAX - 1))
-                 : int32_t(product));
+    res.setInt32(WrappingMultiply(a, b));
     return true;
 }
 
@@ -686,29 +685,23 @@ js::ecmaPow(double x, double y)
 }
 
 bool
-js::math_pow_handle(JSContext* cx, HandleValue base, HandleValue power, MutableHandleValue result)
+js::math_pow(JSContext* cx, unsigned argc, Value* vp)
 {
+    CallArgs args = CallArgsFromVp(argc, vp);
+
     double x;
-    if (!ToNumber(cx, base, &x))
+    if (!ToNumber(cx, args.get(0), &x))
         return false;
 
     double y;
-    if (!ToNumber(cx, power, &y))
+    if (!ToNumber(cx, args.get(1), &y))
         return false;
 
     double z = ecmaPow(x, y);
-    result.setNumber(z);
+    args.rval().setNumber(z);
     return true;
 }
 
-bool
-js::math_pow(JSContext* cx, unsigned argc, Value* vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    return math_pow_handle(cx, args.get(0), args.get(1), args.rval());
-}
-
 uint64_t
 js::GenerateRandomSeed()
 {