[bigint] Fix RightShift by 32

Bug: v8:6791
Change-Id: I9c1ebddfab9f3d73642e61e43c3fbfd739efd56c
Reviewed-on: https://chromium-review.googlesource.com/736722
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48942}

src/objects/bigint.cc

@@ -1017,7 +1017,7 @@ void BigInt::InplaceRightShift(int shift) {
   DCHECK_GE(shift, 0);
   DCHECK_LT(shift, kDigitBits);
   DCHECK_GT(length(), 0);
-  DCHECK_EQ(digit(0) & ((1 << shift) - 1), 0);
+  DCHECK_EQ(digit(0) & ((static_cast<digit_t>(1) << shift) - 1), 0);
   if (shift == 0) return;
   digit_t carry = digit(0) >> shift;
   int last = length() - 1;
@@ -1129,7 +1129,8 @@ Handle<BigInt> BigInt::RightShiftByAbsolute(Handle<BigInt> x,
   // large enough up front, it avoids having to do a second allocation later.
   bool must_round_down = false;
   if (sign) {
-    if ((x->digit(digit_shift) & ((1 << bits_shift) - 1)) != 0) {
+    const digit_t mask = (static_cast<digit_t>(1) << bits_shift) - 1;
+    if ((x->digit(digit_shift) & mask) != 0) {
       must_round_down = true;
     } else {
       for (int i = 0; i < digit_shift; i++) {

test/mjsunit/harmony/bigint/sar.js

@@ -10,6 +10,10 @@ var data = [{
   a: "-4efa0d1f8a127",
   b: "-66",
   r: "-13be8347e2849c0000000000000000000000000"
+}, {
+  a: "-100000001",
+  b: "20",
+  r: "-2"
 }, {
   a: "853cd87b0bd5c046aecbf4b3d",
   b: "-96",