[bigint] Fix possibly-uninitialized leading digit on right shift

jakobkummerow · Commit Bot · commit e82a3b4d47a9 · 2020-11-26T09:24:15.000Z
Fixed: chromium:1151890 Change-Id: I26f5c76494a9ff3f5a141f381e1c9a543e368571 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2561618 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#71422}
diff --git a/src/objects/bigint.cc b/src/objects/bigint.cc
@@ -1874,6 +1874,8 @@ Handle<BigInt> MutableBigInt::RightShiftByAbsolute(Isolate* isolate,
   DCHECK_LE(result_length, length);
   Handle<MutableBigInt> result = New(isolate, result_length).ToHandleChecked();
   if (bits_shift == 0) {
+    // Zero out any overflow digit (see "rounding_can_overflow" above).
+    result->set_digit(result_length - 1, 0);
     for (int i = digit_shift; i < length; i++) {
       result->set_digit(i - digit_shift, x->digit(i));
     }
diff --git a/test/mjsunit/regress/regress-crbug-1151890.js b/test/mjsunit/regress/regress-crbug-1151890.js
@@ -0,0 +1,11 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+for (let i = 0, j = 0; i < 10; ++i) {
+  let x = (-0xffffffffffffffff_ffffffffffffffffn >> 0x40n);
+  assertEquals(-0x10000000000000000n, x);
+  %SimulateNewspaceFull();
+}

Original file line number	Diff line number	Diff line change
`@@ -1874,6 +1874,8 @@ Handle<BigInt> MutableBigInt::RightShiftByAbsolute(Isolate* isolate,`
`1874`	`1874`	`DCHECK_LE(result_length, length);`
`1875`	`1875`	`Handle<MutableBigInt> result = New(isolate, result_length).ToHandleChecked();`
`1876`	`1876`	`if (bits_shift == 0) {`
	`1877`	`+ // Zero out any overflow digit (see "rounding_can_overflow" above).`
	`1878`	`+ result->set_digit(result_length - 1, 0);`
`1877`	`1879`	`for (int i = digit_shift; i < length; i++) {`
`1878`	`1880`	`result->set_digit(i - digit_shift, x->digit(i));`
`1879`	`1881`	`}`