Return false in TryNumberToSize if there is a cast error

src/conversions-inl.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CONVERSIONS_INL_H_
 #define V8_CONVERSIONS_INL_H_
 
 #include <float.h>         // Required for DBL_MAX and on Win32 for finite()
 #include <limits.h>        // Required for INT_MAX etc.
 #include <stdarg.h>
@@ skipping 136 matching lines @@
     DCHECK(static_cast<unsigned>(Smi::kMaxValue) <=
            std::numeric_limits<size_t>::max());
     if (value >= 0) {
       *result = static_cast<size_t>(value);
       return true;
     }
     return false;
   } else {
     DCHECK(number->IsHeapNumber());
     double value = HeapNumber::cast(number)->value();
     if (value >= 0 && value <= std::numeric_limits<size_t>::max()) {

[ahaas, 2016/12/07 16:20:38]

The problem here is that if you compare a double with a size_t, the size_t is
cast implicitly to double, and if you cast std::numeric_limits<size_t>::max() to
double you get 0x10000000000000000. Knowing that, I think the solution here
should just be to write
if (value >= 0 && value <
static_cast<double>(std::numeric_limits<size_t>::max())) with "<" instead of
"<=", and with the static_cast to make this issue more obvious.

[qiuyi.zqy, 2016/12/07 18:13:36]

Done.

       *result = static_cast<size_t>(value);
+      // Cast error. Could happen when value is slightly larger than
+      // the limit of size_t but has a floating number precision loss.
+      if (value > 0 && *result == 0) {
+        return false;
+      }
       return true;
     } else {
       return false;
     }
   }
 }
 
 size_t NumberToSize(Object* number) {
   size_t result = 0;
   bool is_valid = TryNumberToSize(number, &result);
@@ skipping 596 matching lines @@
   buffer[buffer_pos] = '\0';
 
   double converted = Strtod(Vector<const char>(buffer, buffer_pos), exponent);
   return (sign == NEGATIVE) ? -converted : converted;
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_CONVERSIONS_INL_H_