Fixes javascript integer overflow check.

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/cpu.h"
@@ skipping 34 matching lines @@
 DEFINE_FLAG(bool, show_internal_names, false,
     "Show names of internal classes (e.g. \"OneByteString\") in error messages "
     "instead of showing the corresponding interface names (e.g. \"String\")");
 DEFINE_FLAG(bool, trace_disabling_optimized_code, false,
     "Trace disabling optimized code.");
 DEFINE_FLAG(int, huge_method_cutoff_in_tokens, 20000,
     "Huge method cutoff in tokens: Disables optimizations for huge methods.");
 DEFINE_FLAG(int, huge_method_cutoff_in_code_size, 200000,
     "Huge method cutoff in unoptimized code size (in bytes).");
 DEFINE_FLAG(bool, throw_on_javascript_int_overflow, false,
-    "Throw an exception when integer arithmetic exceeds 53 bits.");
+    "Throw an exception when the result of an integer calculation will not "
+    "fit into a javascript integer.");
 DECLARE_FLAG(bool, trace_compiler);
 DECLARE_FLAG(bool, eliminate_type_checks);
 DECLARE_FLAG(bool, enable_type_checks);
 
 static const char* kGetterPrefix = "get:";
 static const intptr_t kGetterPrefixLength = strlen(kGetterPrefix);
 static const char* kSetterPrefix = "set:";
 static const intptr_t kSetterPrefixLength = strlen(kSetterPrefix);
 
 cpp_vtable Object::handle_vtable_ = 0;
@@ skipping 11160 matching lines @@
   return "Integer";
 }
 
 
 void Integer::PrintToJSONStream(JSONStream* stream, bool ref) const {
   stream->OpenObject();
   stream->CloseObject();
 }
 
 
-// Throw FiftyThreeBitOverflow exception.
-static void ThrowFiftyThreeBitOverflow(const Integer& i) {
+// Throw JavascriptIntegerOverflow exception.
+static void ThrowJavascriptIntegerOverflow(const Integer& i) {
   const Array& exc_args = Array::Handle(Array::New(1));
   const String& i_str = String::Handle(String::New(i.ToCString()));
   exc_args.SetAt(0, i_str);
-  Exceptions::ThrowByType(Exceptions::kFiftyThreeBitOverflowError, exc_args);
+  Exceptions::ThrowByType(Exceptions::kJavascriptIntegerOverflowError,
+      exc_args);
 }
 
 
 RawInteger* Integer::New(const String& str, Heap::Space space) {
   // We are not supposed to have integers represented as two byte strings.
   ASSERT(str.IsOneByteString());
   int64_t value;
   if (!OS::StringToInt64(str.ToCString(), &value)) {
     const Bigint& big = Bigint::Handle(Bigint::New(str, space));
     ASSERT(!BigintOperations::FitsIntoSmi(big));
     ASSERT(!BigintOperations::FitsIntoInt64(big));
     if (FLAG_throw_on_javascript_int_overflow) {
-      ThrowFiftyThreeBitOverflow(big);
+      ThrowJavascriptIntegerOverflow(big);
     }
     return big.raw();
   }
   return Integer::New(value, space);
 }
 
 
 // This is called from LiteralToken::New() in the parser, so we can't
-// raise an exception for 53-bit overflow here. Instead we do it in
+// raise an exception for 54-bit overflow here. Instead we do it in
 // Parser::CurrentIntegerLiteral(), which is the point in the parser where
 // integer literals escape, so we can call Parser::ErrorMsg().
 RawInteger* Integer::NewCanonical(const String& str) {
   // We are not supposed to have integers represented as two byte strings.
   ASSERT(str.IsOneByteString());
   int64_t value;
   if (!OS::StringToInt64(str.ToCString(), &value)) {
     const Bigint& big = Bigint::Handle(Bigint::NewCanonical(str));
     ASSERT(!BigintOperations::FitsIntoSmi(big));
     ASSERT(!BigintOperations::FitsIntoInt64(big));
     return big.raw();
   }
   if ((value <= Smi::kMaxValue) && (value >= Smi::kMinValue)) {
     return Smi::New(value);
   }
   return Mint::NewCanonical(value);
 }
 
 
+// dart2js represents integers as double precision floats. It does this using
+// a sign bit and 53 fraction bits. This gives us the range
+// -2^54 - 1 ... 2^54 - 1, i.e. the same as a 54-bit signed integer

[Florian Schneider, 2013/08/01 15:45:03]

Something is slightly off here: a int54_t has a range -2^53..2^53-1.

JavaScript numbers are precise  in the range -2^53..2^53.

Try "Math.pow(2, 53)+1 == Math.pow(2, 53)". It yields true.

+// without the most negative number. Thus, here we check if the value is
+// a 54-bit signed integer and not -2^54
+static bool Is54BitNoMinInt(int64_t value) {
+  return (Utils::IsInt(54, value)) && (value != (-0x1FFFFFFFFFFFFF - 1));

[Florian Schneider, 2013/08/02 10:24:17]

I think this should be

return Utils::IsInt(54, value) || (value == 0x20000000000000);

+}
+
+
 RawInteger* Integer::New(int64_t value, Heap::Space space) {
   if ((value <= Smi::kMaxValue) && (value >= Smi::kMinValue)) {
     return Smi::New(value);
   }
-  if (FLAG_throw_on_javascript_int_overflow && !Utils::IsInt(53, value)) {
+  if (FLAG_throw_on_javascript_int_overflow && !Is54BitNoMinInt(value)) {
     const Integer &i = Integer::Handle(Mint::New(value));
-    ThrowFiftyThreeBitOverflow(i);
+    ThrowJavascriptIntegerOverflow(i);
   }
   return Mint::New(value, space);
 }
 
 
 RawInteger* Integer::NewFromUint64(uint64_t value, Heap::Space space) {
   if (value > static_cast<uint64_t>(Mint::kMaxValue)) {
     if (FLAG_throw_on_javascript_int_overflow) {
       const Integer &i =
           Integer::Handle(BigintOperations::NewFromUint64(value));
-      ThrowFiftyThreeBitOverflow(i);
+      ThrowJavascriptIntegerOverflow(i);
     }
     return BigintOperations::NewFromUint64(value);
   } else {
     return Integer::New(value);
   }
 }
 
 
 double Integer::AsDoubleValue() const {
   UNIMPLEMENTED();
   return 0.0;
 }
 
 
 int64_t Integer::AsInt64Value() const {
   UNIMPLEMENTED();
   return 0;
 }
 
 
 int Integer::CompareWith(const Integer& other) const {
   UNIMPLEMENTED();
   return 0;
 }
 
 
-// Returns true if the signed Integer requires more than 53 bits.
-bool Integer::CheckFiftyThreeBitOverflow() const {
+// Returns true if the signed Integer does not fit into a
+// Javascript (54-bit) integer.
+bool Integer::CheckJavascriptIntegerOverflow() const {
   // Always overflow if the value doesn't fit into an int64_t.
   int64_t value = 1ULL << 63;
   if (IsSmi()) {
     value = AsInt64Value();
   } else if (IsMint()) {
     Mint& mint = Mint::Handle();
     mint ^= raw();
     value = mint.value();
   } else {
     ASSERT(IsBigint());
     Bigint& big_value = Bigint::Handle();
     big_value ^= raw();
     if (BigintOperations::FitsIntoInt64(big_value)) {
       value = BigintOperations::ToInt64(big_value);
     }
   }
-  return !Utils::IsInt(53, value);
+  return !Is54BitNoMinInt(value);
 }
 
 
 RawInteger* Integer::AsValidInteger() const {
   if (FLAG_throw_on_javascript_int_overflow &&
-      CheckFiftyThreeBitOverflow()) {
-    ThrowFiftyThreeBitOverflow(*this);
+      CheckJavascriptIntegerOverflow()) {
+    ThrowJavascriptIntegerOverflow(*this);
   }
   if (IsSmi()) return raw();
   if (IsMint()) {
     Mint& mint = Mint::Handle();
     mint ^= raw();
     if (Smi::IsValid64(mint.value())) {
       return Smi::New(mint.value());
     } else {
       return raw();
     }
@@ skipping 3019 matching lines @@
 }
 
 
 void MirrorReference::PrintToJSONStream(JSONStream* stream, bool ref) const {
   stream->OpenObject();
   stream->CloseObject();
 }
 
 
 }  // namespace dart