MIPS: Fix infinite loop in Math.pow(2,-2147483648)

src/mips64/code-stubs-mips64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_MIPS64
 
 #include "src/code-stubs.h"
 #include "src/api-arguments.h"
 #include "src/bootstrapper.h"
 #include "src/codegen.h"
@@ skipping 802 matching lines @@
     __ mov(scratch, exponent);
   } else {
     // Exponent has previously been stored into scratch as untagged integer.
     __ mov(exponent, scratch);
   }
 
   __ mov_d(double_scratch, double_base);  // Back up base.
   __ Move(double_result, 1.0);
 
   // Get absolute value of exponent.
-  Label positive_exponent;
+  Label positive_exponent, bail_out;
   __ Branch(&positive_exponent, ge, scratch, Operand(zero_reg));
   __ Dsubu(scratch, zero_reg, scratch);
+  // Check when Dsubu overflows and we get negative result
+  // (happens only when input is MIN_INT).
+  __ Branch(&bail_out, gt, zero_reg, Operand(scratch));
   __ bind(&positive_exponent);
+  __ Assert(ge, kUnexpectedNegativeValue, scratch, Operand(zero_reg));
 
   Label while_true, no_carry, loop_end;
   __ bind(&while_true);
 
   __ And(scratch2, scratch, 1);
 
   __ Branch(&no_carry, eq, scratch2, Operand(zero_reg));
   __ mul_d(double_result, double_result, double_scratch);
   __ bind(&no_carry);
 
@@ skipping 12 matching lines @@
   // Test whether result is zero.  Bail out to check for subnormal result.
   // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
   __ BranchF(&done, NULL, ne, double_result, kDoubleRegZero);
 
   // double_exponent may not contain the exponent value if the input was a
   // smi.  We set it with exponent value before bailing out.
   __ mtc1(exponent, single_scratch);
   __ cvt_d_w(double_exponent, single_scratch);
 
   // Returning or bailing out.
+  __ bind(&bail_out);
   __ push(ra);
   {
     AllowExternalCallThatCantCauseGC scope(masm);
     __ PrepareCallCFunction(0, 2, scratch);
     __ MovToFloatParameters(double_base, double_exponent);
     __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
                      0, 2);
   }
   __ pop(ra);
   __ MovFromFloatResult(double_result);
@@ skipping 4569 matching lines @@
                            kStackUnwindSpace, kInvalidStackOffset,
                            return_value_operand, NULL);
 }
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_MIPS64