Fix runtime error: left shift of negative value (#4957)

This patch fixes #4701

JerryScript-DCO-1.0-Signed-off-by: Daniel Batiz daniel.batiz@h-lab.eu

Author: batizdaniel

jerry-core/vm/opcodes-ecma-bitwise.c

@@ -93,7 +93,7 @@ do_number_bitwise_logic (number_bitwise_logic_op op, /**< number bitwise logic o
       }
       case NUMBER_BITWISE_SHIFT_LEFT:
       {
-        result = (ecma_number_t) (ecma_number_to_int32 (left_number) << (right_uint32 & 0x1F));
+        result = (ecma_number_t) ((int32_t) ((uint32_t) ecma_number_to_int32 (left_number) << (right_uint32 & 0x1F)));
         break;
       }
       case NUMBER_BITWISE_SHIFT_RIGHT:

tests/jerry/shift.js

@@ -31,3 +31,14 @@ assert((9 >> 2) === 2);
 assert((-14 >> 2) === -4);
 
 assert((9 >>> 2) === (9 >> 2));
+
+assert(("-1.234" << 0) == -1);
+assert(("-1.234" << -1) == -2147483648);
+assert((-1.2 << 0) === -1);
+assert((-1.1 << -1) === -2147483648);
+assert((-1.1 << -1.1) === -2147483648);
+assert((-1.1 << -999) === -33554432);
+assert((-1.1 << 999) === -128);
+assert((-33554431.0 << 0) === -33554431);
+assert((-33554431.0 << -1.1) === -2147483648);
+assert((-33554431.0 << -999) === 33554432);