diff --git a/src/objects/bigint.cc b/src/objects/bigint.cc index a8fb9c1572..7c562465cb 100644 --- a/src/objects/bigint.cc +++ b/src/objects/bigint.cc @@ -1874,6 +1874,8 @@ Handle MutableBigInt::RightShiftByAbsolute(Isolate* isolate, DCHECK_LE(result_length, length); Handle result = New(isolate, result_length).ToHandleChecked(); if (bits_shift == 0) { + // Zero out any overflow digit (see "rounding_can_overflow" above). + result->set_digit(result_length - 1, 0); for (int i = digit_shift; i < length; i++) { result->set_digit(i - digit_shift, x->digit(i)); } diff --git a/test/mjsunit/regress/regress-crbug-1151890.js b/test/mjsunit/regress/regress-crbug-1151890.js new file mode 100644 index 0000000000..70a3d6bbf0 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-1151890.js @@ -0,0 +1,11 @@ +// Copyright 2020 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +for (let i = 0, j = 0; i < 10; ++i) { + let x = (-0xffffffffffffffff_ffffffffffffffffn >> 0x40n); + assertEquals(-0x10000000000000000n, x); + %SimulateNewspaceFull(); +}