SERVER-22461 Crash in mozjs code with invalid NumberLong objectt

1 files changed, 29 insertions, 1 deletions

diff --git a/jstests/core/numberlong.js b/jstests/core/numberlong.js
index 4f1d27d6cb0..acbde248889 100644
--- a/jstests/core/numberlong.js
+++ b/jstests/core/numberlong.js
@@ -25,6 +25,21 @@ a.a = n;
 p = tojson( a );
 assert.eq.automsg( "'{ \"a\" : NumberLong(-4) }'", "p" );
 
+// double
+n = new NumberLong(4294967296); // 2^32
+assert.eq.automsg( "4294967296", "n" );
+assert.eq.automsg( "4294967296", "n.toNumber()" );
+assert.eq.automsg( "4294967295", "n - 1" );
+assert.eq.automsg( "'NumberLong(\"4294967296\")'", "n.toString()" );
+assert.eq.automsg( "'NumberLong(\"4294967296\")'", "tojson( n )" );
+assert.eq.automsg( "4294967296", "n.floatApprox" );
+assert.eq.automsg( "", "n.top" );
+assert.eq.automsg( "", "n.bottom" );
+a = {}
+a.a = n;
+p = tojson( a );
+assert.eq.automsg( "'{ \"a\" : NumberLong(\"4294967296\") }'", "p" );
+
 // too big to fit in double
 n = new NumberLong( "11111111111111111" );
 assert.eq.automsg( "11111111111111112", "n.toNumber()" );
@@ -44,11 +59,24 @@ assert.eq.automsg( "-11111111111111112", "n.toNumber()" );
 assert.eq.automsg( "-11111111111111108", "n + 4" );
 assert.eq.automsg( "'NumberLong(\"-11111111111111111\")'", "n.toString()" );
 assert.eq.automsg( "'NumberLong(\"-11111111111111111\")'", "tojson( n )" );
-a = {};
+assert.eq.automsg( "-11111111111111112", "n.floatApprox" );
+assert.eq.automsg( "4292380288", "n.top" );
+assert.eq.automsg( "3643379257", "n.bottom" );
+a = {}
 a.a = n;
 p = tojson( a );
 assert.eq.automsg( "'{ \"a\" : NumberLong(\"-11111111111111111\") }'", "p" );
 
+n = new NumberLong( "9223372036854775807" );
+assert.eq.automsg( "9223372036854775807", "n.floatApprox" );
+assert.eq.automsg( "2147483647", "n.top" );
+assert.eq.automsg( "4294967295", "n.bottom" );
+
+n = new NumberLong( 9223372036854775807, 2147483647, 4294967295 );
+assert.eq.automsg( "9223372036854775807", "n.floatApprox" );
+assert.eq.automsg( "2147483647", "n.top" );
+assert.eq.automsg( "4294967295", "n.bottom" );
+
 // parsing
 assert.throws.automsg( function() { new NumberLong( "" ); } );
 assert.throws.automsg( function() { new NumberLong( "y" ); } );