Bug 210865 – [JSC] Add JSBigInt::validate to ensure produced JSBigInt meets its invariant

• Status: NEW
• Component: JavaScriptCore

[Yusuke Suzuki]

...

[Yusuke Suzuki]

Created attachment 397292 [details]
Patch

[Keith Miller]

Comment on attachment 397292 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=397292&action=review

r=me.

> Source/JavaScriptCore/ChangeLog:9
> +        Wrap public facing JSBigInt functions with `validate([&] { })` to validate the generated JSBigInt meets the invariant
> +        to catch bugs like r260522.

Can't say I'm a huge fan of this style... Is there any way we can do it with a ScopeExit type thing? I can't think of anything right now but I could be missing something.

> Source/JavaScriptCore/runtime/JSBigInt.h:302
> +    if (bigInt) {
> +        if (bigInt->length() == 0)
> +            ASSERT(!bigInt->sign());
> +        else
> +            ASSERT(bigInt->digit(bigInt->length() - 1));
> +    }
> +    return bigInt;

Is it possible to vend HeapBigInts for 32-bit values? If not, should we assert that here?