cdb882518d
When the FFT multiplication algorithm invokes itself for the recursive steps, the input is "mod Fn"-normalized, i.e. it is at most of the shape (1 << N), but we only read N bits of it, so in the rare case where it was exactly 1 << N, that lone top bit was ignored, leading to an incorrect result of the overall multiplication. Fixed: chromium:1228267 Change-Id: I7b245fc3701696d95e5d75fb970f02d72ce40ff8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3032081 Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#75755}
24 lines
895 B
JavaScript
24 lines
895 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function fastAssertEquals(expected, actual) {
|
|
if (expected === actual) return;
|
|
// Formatting large BigInts to base-10 string is slow and verbose, so format
|
|
// them to hex strings and report only a prefix.
|
|
throw new MjsUnitAssertionError(
|
|
'Failure:\nexpected:\n0x' +
|
|
expected.toString(16).substring(0, 1000) +
|
|
'...n\nfound:\n0x' +
|
|
actual.toString(16).substring(0, 1000) + '...n');
|
|
}
|
|
|
|
function regress_1228267(power) {
|
|
let a = 2n ** power;
|
|
let a_squared = a * a;
|
|
let expected = 2n ** (2n * power);
|
|
fastAssertEquals(expected, a_squared);
|
|
}
|
|
regress_1228267(1273000n); // This triggered the bug on 32-bit platforms.
|
|
regress_1228267(2564000n); // This triggered the bug on 64-bit platforms.
|