Fix UB in double-to-int conversions across JSC

[dylan-conway]

Converting a double to a narrow integer with static_cast/C-cast is undefined behavior when the value is NaN, infinite, or outside the target range. Newer compilers exploit this — they assume the value is in range and delete a following round-trip/range check, yielding a wrong (often sign-wrapped) result. Each site below takes an unbounded, caller-controlled double straight to the cast.

• DFGOperations parseIntResult — parseInt("80000000", 16) boxed as a negative int32 in optimized builds
• LiteralParser JSONP array index
• JSValue::getUInt32 — property-subscript fast path
• String.fromCodePoint code point
• Number.prototype.toExponential/toPrecision digit count (range check ran after the cast)
• Inspector weakMapEntries/iteratorEntries fetch count (+Infinity passed the >= 0 guard)
• LLInt slow_path_switch_imm scrutinee — switch (2**31) could match a case -2147483648: label once the wrapped cast result passed the folded range check

Each is made defined via truncateDoubleToInt32(), clampTo<>(), or a range check on the double before narrowing. Same class as #179 and #232.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 499fec7b-1ad6-46db-a75c-2520782dcf64

📥 Commits

Reviewing files that changed from the base of the PR and between 04b3738 and d19a17e.

📒 Files selected for processing (1)

• Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

---

Walkthrough

Replace direct double-to-int/uint casts with truncateDoubleToInt32/truncateDoubleToUint32 and clamp inspector fetch counts with clampTo; keep existing equality and range checks and original behavior paths.

Changes

Numeric parsing and validation

Layer / File(s)	Summary
parseIntResult truncation implementation Source/JavaScriptCore/dfg/DFGOperations.cpp	parseIntResult converts double input to int32_t via truncateDoubleToInt32 instead of static_cast<int>, with subsequent correctness verification and value encoding unchanged.
LiteralParser JSONP index truncation Source/JavaScriptCore/runtime/LiteralParser.cpp	JSONP bracket-index parsing uses truncateDoubleToInt32 for converting floating tokens before exactness and range checks.
JSValue getUInt32 truncation Source/JavaScriptCore/runtime/JSCJSValue.h	getUInt32 truncates double values with truncateDoubleToUint32 before comparing to the original double.
NumberPrototype toExponential/toPrecision validation Source/JavaScriptCore/runtime/NumberPrototype.cpp	Capture optional argument as double from toIntegerOrInfinity, validate it lies in 0..100 / 1..100 as a double, then cast to int for formatting.
stringFromCodePoint double-range and integer checks Source/JavaScriptCore/runtime/StringConstructor.cpp	Convert code point argument with truncateDoubleToUint32, then validate integer-ness and range (<= UCHAR_MAX_VALUE) before appending UTF-16 or throwing RangeError.
LLInt switch scrutinee truncation Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	slow_path_switch_imm uses truncateDoubleToInt32 to derive the int32 case value from a double scrutinee before switch dispatch.

Inspector fetch clamping

Layer / File(s)	Summary
weakMap and iterator fetch clamping Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp	weakMapEntries and iteratorEntries use clampTo<unsigned>(...) when computing snapshot and iterator fetch counts instead of manual negative checks or direct casts.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and accurately describes the main change: fixing undefined behavior in double-to-int conversions across JSC, which aligns with all modified files.
Description check	✅ Passed	The description explains the bug (UB in double narrowing), provides specific examples from each changed file, and describes the fix approach, but lacks a Bugzilla link and Reviewed-by line as required by the template.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Preview Builds

Commit	Release	Date
d19a17e7	autobuild-preview-pr-244-d19a17e7	2026-06-02 03:51:10 UTC
04b37384	autobuild-preview-pr-244-04b37384	2026-06-02 01:26:41 UTC