From 394e93458570c3773192792c3203fa677580a162 Mon Sep 17 00:00:00 2001
From: 1820893135-pixel <1820893135@qq.com>
Date: Wed, 23 Sep 2026 16:31:42 +0800
Subject: [PATCH] Fix undefined double-to-int cast in
 lexer_construct_number_object

lexer_construct_number_object() tries to fold a numeric literal into a
CBC_PUSH_NUMBER_BYTE_RANGE immediate by casting the parsed double to
int32_t and then checking whether the cast round-trips:

    int32_t int_num = (int32_t) num;
    if (int_num == num && ...)

For a literal outside the int32_t range the cast itself is already
undefined behaviour; it is not the comparison that guards it.  Under
-fsanitize=undefined (the OSS-Fuzz configuration) this traps:

    js-lexer.c:2539:25: runtime error: 1e+308 is outside the range of
    representable values of type 'int'

The input is plain, valid JavaScript, so any host that evaluates
untrusted source (jerry_parse / jerry_eval) deterministically aborts:
`var a = 1e308;` is enough.

Move the range test in front of the cast:

    if (is_expr && num >= (ecma_number_t) INT32_MIN
                && num <= (ecma_number_t) INT32_MAX)
    {
      int32_t int_num = (int32_t) num;
      ...

Literals outside the range simply take the float path, which is what
already happened for every value the fold did not apply to.

JerryScript-DCO-1.0-Signed-off-by: 1820893135-pixel <1820893135@qq.com>
---
 jerry-core/parser/js/js-lexer.c     |  5 ++-
 tests/jerry/number-literal-range.js | 48 +++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 tests/jerry/number-literal-range.js

diff --git a/jerry-core/parser/js/js-lexer.c b/jerry-core/parser/js/js-lexer.c
index d6305cbd2f..4311bb9cf0 100644
--- a/jerry-core/parser/js/js-lexer.c
+++ b/jerry-core/parser/js/js-lexer.c
@@ -2534,7 +2534,10 @@ lexer_construct_number_object (parser_context_t *context_p, /**< context */
       num = ecma_utf8_string_to_number (context_p->token.lit_location.char_p, length, options);
     }
 
-    if (is_expr)
+    /* Only try to fold the literal into a CBC_PUSH_NUMBER_BYTE_RANGE immediate when it
+     * is inside the int32_t range.  For a double outside that range (e.g. 1e308) the
+     * cast is undefined behaviour and traps under -fsanitize=undefined. */
+    if (is_expr && num >= (ecma_number_t) INT32_MIN && num <= (ecma_number_t) INT32_MAX)
     {
       int32_t int_num = (int32_t) num;
 
diff --git a/tests/jerry/number-literal-range.js b/tests/jerry/number-literal-range.js
new file mode 100644
index 0000000000..30788ff386
--- /dev/null
+++ b/tests/jerry/number-literal-range.js
@@ -0,0 +1,48 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Numeric literals outside the int32_t range must not be folded into a
+// CBC_PUSH_NUMBER_BYTE_RANGE immediate.  The parser used to cast the double to
+// int32_t before testing the range, which is undefined behaviour and traps
+// under -fsanitize=undefined.  All of the inputs below are plain, valid
+// JavaScript.
+
+assert (1e308 === 1e308);
+assert (-1e308 === -1e308);
+assert (1.7976931348623157e308 === Number.MAX_VALUE);
+assert (-1.5e10 === -15000000000);
+assert (1.5e300 + 0.5 === 1.5e300);
+assert ([1e308][0] === 1e308);
+assert ((1e308 | 0) === 0);
+assert (1e308 > 0);
+assert (-1e308 < 0);
+
+// Numeric literals inside the range must keep working as before.
+assert (0 === 0);
+assert (1 === 1);
+assert (255 === 255);
+assert (256 === 256);
+assert (-1 === -1);
+assert ((255 ^ 15) === 240);
+assert ((1 << 20) === 1048576);
+assert (3.14159 === 3.14159);
+
+var a = 0xFF ^ 0x0F;
+var b = 1 << 20;
+a += b;
+assert (a === 1048816);
+
+var c = 3.14159;
+var d = -1.5e10;
+assert ((a * c + d) < 0);