Fix DoubleToRadixCString wrt Number.MIN_VALUE.

src/conversions.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/conversions.h"
 
 #include <limits.h>
 #include <stdarg.h>
 #include <cmath>
 
@@ skipping 418 matching lines @@
   int fraction_cursor = integer_cursor;
 
   bool negative = value < 0;
   if (negative) value = -value;
 
   // Split the value into an integer part and a fractional part.
   double integer = std::floor(value);
   double fraction = value - integer;
   // We only compute fractional digits up to the input double's precision.
   double delta = 0.5 * (Double(value).NextDouble() - value);
+  delta = std::max(Double(0.0).NextDouble(), delta);
+  DCHECK_GT(delta, 0.0);
   if (fraction > delta) {
     // Insert decimal point.
     buffer[fraction_cursor++] = '.';
     do {
       // Shift up by one digit.
       fraction *= radix;
       delta *= radix;
       // Write digit.
       int digit = static_cast<int>(fraction);
       buffer[fraction_cursor++] = chars[digit];
@@ skipping 32 matching lines @@
   }
   do {
     double remainder = modulo(integer, radix);
     buffer[--integer_cursor] = chars[static_cast<int>(remainder)];
     integer = (integer - remainder) / radix;
   } while (integer > 0);
 
   // Add sign and terminate string.
   if (negative) buffer[--integer_cursor] = '-';
   buffer[fraction_cursor++] = '\0';
+  DCHECK_LT(fraction_cursor, kBufferSize);
+  DCHECK_LE(0, integer_cursor);
   // Allocate new string as return value.
   char* result = NewArray<char>(fraction_cursor - integer_cursor);
   memcpy(result, buffer + integer_cursor, fraction_cursor - integer_cursor);
   return result;
 }
 
 
 // ES6 18.2.4 parseFloat(string)
 double StringToDouble(UnicodeCache* unicode_cache, Handle<String> string,
                       int flags, double empty_string_val) {
@@ skipping 65 matching lines @@
   char reverse_buffer[kBufferSize + 1];  // Result will be /0 terminated.
   Vector<char> reverse_vector(reverse_buffer, arraysize(reverse_buffer));
   const char* reverse_string = DoubleToCString(d, reverse_vector);
   for (int i = 0; i < length; ++i) {
     if (static_cast<uint16_t>(reverse_string[i]) != buffer[i]) return false;
   }
   return true;
 }
 }  // namespace internal
 }  // namespace v8