Bug 893364: in asm.js mode, correctly compute ranges for add and sub;