[bigint] Fixes for issues found in local testing

- The fallback path for "digit_mul" was missing shifts
- RightTrim() could end up reading digit(-1) (i.e. the bit field)
- Add SLOW_DCHECKs to digit()/set_digit() to catch any further
  invalid-index issues

Bug: v8:6791
Change-Id: I901edfce90bb6ac11e74c3c3f577225f12bad177
Reviewed-on: https://chromium-review.googlesource.com/683796Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48193}

src/objects/bigint-inl.h

@@ -36,10 +36,12 @@ void BigInt::set_sign(bool new_sign) {
 }
 
 BigInt::digit_t BigInt::digit(int n) const {
+  SLOW_DCHECK(0 <= n && n < length());
   const byte* address = FIELD_ADDR_CONST(this, kDigitsOffset + n * kDigitSize);
   return *reinterpret_cast<digit_t*>(reinterpret_cast<intptr_t>(address));
 }
 void BigInt::set_digit(int n, digit_t value) {
+  SLOW_DCHECK(0 <= n && n < length());
   byte* address = FIELD_ADDR(this, kDigitsOffset + n * kDigitSize);
   (*reinterpret_cast<digit_t*>(reinterpret_cast<intptr_t>(address))) = value;
 }

src/objects/bigint.cc

@@ -573,7 +573,7 @@ Handle<BigInt> BigInt::Copy(Handle<BigInt> source) {
 void BigInt::RightTrim() {
   int old_length = length();
   int new_length = old_length;
-  while (digit(new_length - 1) == 0) new_length--;
+  while (new_length > 0 && digit(new_length - 1) == 0) new_length--;
   int to_trim = old_length - new_length;
   if (to_trim == 0) return;
   int size_delta = to_trim * kDigitSize;
@@ -704,8 +704,8 @@ inline BigInt::digit_t BigInt::digit_mul(digit_t a, digit_t b, digit_t* high) {
   digit_t r_high = a_high * b_high;
 
   digit_t carry = 0;
-  digit_t low = digit_add(r_low, r_mid1 & kHalfDigitMask, &carry);
-  low = digit_add(low, r_mid2 & kHalfDigitMask, &carry);
+  digit_t low = digit_add(r_low, r_mid1 << kHalfDigitBits, &carry);
+  low = digit_add(low, r_mid2 << kHalfDigitBits, &carry);
   *high =
       (r_mid1 >> kHalfDigitBits) + (r_mid2 >> kHalfDigitBits) + r_high + carry;
   return low;