Fix handling of large negative Error.stackTraceLimit.

Author: woess

graal-js/src/com.oracle.truffle.js.test/js/runtime/error_stacktracelimit.js

@@ -46,8 +46,14 @@ assertThrows(() => recurse(20), MyError);
 Object.defineProperty(Error, "stackTraceLimit", {value: 5, configurable: true, writable: true})
 assertThrows(() => recurse(20), MyError, e => assertSame(5, countOccurrences(e.stack, 'recurse')));
 
+// stackTraceLimit missing or not of type Number.
+var emptyStack = e => {assertSame(0, countOccurrences(String(e.stack), 'recurse')); assertSame(true, 'stack' in e);};
+
 Error.stackTraceLimit = 0;
-assertThrows(() => recurse(20), MyError, e => {assertSame(0, countOccurrences(String(e.stack), 'recurse')); assertSame(true, 'stack' in e);});
+assertThrows(() => recurse(20), MyError, emptyStack);
+
+Error.stackTraceLimit = -2147483649;
+assertThrows(() => recurse(20), MyError, emptyStack);
 
 // stackTraceLimit missing or not of type Number.
 var invalidLimit = e => {assertSame(0, countOccurrences(String(e.stack), 'recurse')); assertSame(true, 'stack' in e);};

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/nodes/access/ErrorStackTraceLimitNode.java

@@ -45,7 +45,7 @@
 import com.oracle.truffle.api.object.DynamicObjectLibrary;
 import com.oracle.truffle.js.nodes.JavaScriptBaseNode;
 import com.oracle.truffle.js.nodes.cast.IsNumberNode;
-import com.oracle.truffle.js.nodes.cast.JSToIntegerAsIntNode;
+import com.oracle.truffle.js.nodes.cast.JSToIntegerAsLongNode;
 import com.oracle.truffle.js.runtime.JSContext;
 import com.oracle.truffle.js.runtime.JSErrorType;
 import com.oracle.truffle.js.runtime.builtins.JSError;
@@ -57,13 +57,13 @@ public abstract class ErrorStackTraceLimitNode extends JavaScriptBaseNode {
     private final JSContext context;
     @Child private DynamicObjectLibrary getStackTraceLimit;
     @Child private IsNumberNode isNumber;
-    @Child private JSToIntegerAsIntNode toInteger;
+    @Child private JSToIntegerAsLongNode toInteger;
 
     protected ErrorStackTraceLimitNode(JSContext context) {
         this.context = context;
         this.getStackTraceLimit = JSObjectUtil.createDispatched(JSError.STACK_TRACE_LIMIT_PROPERTY_NAME);
         this.isNumber = IsNumberNode.create();
-        this.toInteger = JSToIntegerAsIntNode.create();
+        this.toInteger = JSToIntegerAsLongNode.create();
     }
 
     public static ErrorStackTraceLimitNode create(JSContext context) {
@@ -76,7 +76,8 @@ public int doInt() {
         if (JSProperty.isData(getStackTraceLimit.getPropertyFlagsOrDefault(errorConstructor, JSError.STACK_TRACE_LIMIT_PROPERTY_NAME, JSProperty.ACCESSOR))) {
             Object value = getStackTraceLimit.getOrDefault(errorConstructor, JSError.STACK_TRACE_LIMIT_PROPERTY_NAME, Undefined.instance);
             if (isNumber.execute(value)) {
-                return Math.max(0, toInteger.executeInt(value));
+                long limit = toInteger.executeLong(value);
+                return (int) Math.max(0, Math.min(limit, Integer.MAX_VALUE));
             }
         }
         return 0;

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/JSException.java

@@ -146,7 +146,7 @@ public static int getStackTraceLimit(JSRealm realm) {
             Object stackTraceLimit = lib.getOrDefault(errorConstructor, JSError.STACK_TRACE_LIMIT_PROPERTY_NAME, Undefined.instance);
             if (JSRuntime.isNumber(stackTraceLimit)) {
                 final long limit = JSRuntime.toInteger(stackTraceLimit);
-                return Math.max(0, limit > Integer.MAX_VALUE ? Integer.MAX_VALUE : (int) limit);
+                return (int) Math.max(0, Math.min(limit, Integer.MAX_VALUE));
             }
         }
         return 0;