Created attachment 397292 [details]
Patch

Comment on attachment 397292 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=397292&action=review

r=me.

> Source/JavaScriptCore/ChangeLog:9
> +        Wrap public facing JSBigInt functions with `validate([&] { })` to validate the generated JSBigInt meets the invariant
> +        to catch bugs like r260522.

Can't say I'm a huge fan of this style... Is there any way we can do it with a ScopeExit type thing? I can't think of anything right now but I could be missing something.

> Source/JavaScriptCore/runtime/JSBigInt.h:302
> +    if (bigInt) {
> +        if (bigInt->length() == 0)
> +            ASSERT(!bigInt->sign());
> +        else
> +            ASSERT(bigInt->digit(bigInt->length() - 1));
> +    }
> +    return bigInt;

Is it possible to vend HeapBigInts for 32-bit values? If not, should we assert that here?