guard non-positive count in GenerateCountedDigits

[jdymitarai]

Problem

PR #306 guarded against count == 0 in GenerateCountedDigits, preventing an out-of-bounds write to buffer[-1]. However, when called with a negative digit count (e.g. count < 0 or negative requested_digits in BignumDtoa with BIGNUM_DTOA_PRECISION), in release builds (-DNDEBUG), the assertion DOUBLE_CONVERSION_ASSERT(count >= 0) is stripped and the count == 0 check evaluates to false.

Execution then proceeds to line 309:

buffer[count - 1] = static_cast<char>(digit + '0');

which writes to buffer[count - 1] before the start of the buffer (e.g. buffer[-2] when count == -1), causing memory corruption / buffer overflow.

Solution

Change if (count == 0) to if (count <= 0) in GenerateCountedDigits to safely treat any non-positive digit count as requesting no digits (*length = 0). This mirrors the non-positive guard introduced in DigitGenCounted in PR #313.

Extend BignumDtoaZeroPrecision in test/cctest/test-bignum-dtoa.cc to verify negative precision values.

[floitsch]

LGTM.