Bug 891070 - IonMonkey: Stronger range analysis for or, xor, and not. r=nbp