Invalid date causes V8 fatal error

[bnoordhuis]

require "mini_racer"
MiniRacer::Context.new.eval("new Date(0xFFFFFFFF, 0xFFFFFFFF)")

$ bundle exec ruby t.rb
/home/bnoordhuis/src/mini_racer/lib/mini_racer.rb:237:in `eval_unsafe': out of Time range (RangeError)
        from /home/bnoordhuis/src/mini_racer/lib/mini_racer.rb:237:in `block (2 levels) in eval'
        from /home/bnoordhuis/src/mini_racer/lib/mini_racer.rb:358:in `timeout'
        from /home/bnoordhuis/src/mini_racer/lib/mini_racer.rb:236:in `block in eval'
        from /home/bnoordhuis/src/mini_racer/lib/mini_racer.rb:234:in `synchronize'
        from /home/bnoordhuis/src/mini_racer/lib/mini_racer.rb:234:in `eval'
        from t.rb:2:in `<main>'

#
# Fatal error in v8::Isolate::Dispose()
# Disposing the isolate that is entered by a thread
#

Trace/breakpoint trap (core dumped)

"out of Time range" is throw by ruby's rb_time_new() function.

[bnoordhuis]

new Date(NaN) has the same isuse. I think the calculation here is broken:

mini_racer/ext/mini_racer_extension/mini_racer_extension.cc

Lines 623 to 625 in 4f552cf

	double ts = Local<Date>::Cast(value)->ValueOf();
	double secs = ts/1000;
	long nanos = round((secs - floor(secs)) * 1000000);

[bnoordhuis]

I think I've figured it out:

1. convert_v8_to_ruby calls rb_time_new calls rb_raise
2. rb_raise longjmps up the stack
3. IsolateScope/HandleScope/etc. destructors don't run
4. V8 is left in an undefined state

rb_time_new is just one instance of this bug category. I saw the same Disposing the isolate that is entered by a thread error after a JSON::ParserError, because mini_racer tries to json-ify the eval result.