Math.imul sometimes returns incorrectly wrapped negative numbers

[sjrd]

Expected, with Node.js v10.0.0:

$ /localhome/doeraene/opt/node-v10.0.0-linux-x64/bin/node -v
v10.0.0
$ /localhome/doeraene/opt/node-v10.0.0-linux-x64/bin/node 
> Math.imul(2147483611, -14)
518

Actual, with Rhino 1.7.9 (also 1.7.7+, since the introduction of Math.imul in 79e11ac):

$ java -jar rhino-1.7.9.jar 
Rhino 1.7.9 2018 03 15
js> Math.imul(2147483611, -14)
-4294966778
js> Math.imul(2147483611, -14) | 0
518

Negative numbers smaller than -2**31 should be wrapped around to the positive side, basically using ToInt32.

[sjrd]

In addition, calling Math.imul with less than two arguments should not return NaN, but 0. That's simply because ToInt32(undefined) === 0. Moreover, if there is only one argument but ToInt32(args[0]) throws, the exception should be thrown, and not swallowed by the early exit with args.length < 2. Here is a transcript from a Node.js session:

$ node
> Math.imul(4)
0
> Math.imul()
0
> var o = { valueOf() { throw new RangeError("meh"); } };
undefined
> Math.imul(o, 5)
RangeError: meh
    at Object.valueOf (repl:1:29)
    at Math.imul (<anonymous>)
> Math.imul(o)
RangeError: meh
    at Object.valueOf (repl:1:29)
    at Math.imul (<anonymous>)

FWIW, I believe the following implementation of js_imul would be correct (untested):

    private Object js_imul(Object[] args)
    {
        if ((args == null) || (args.length == 0)) {
            return ScriptRuntime.toNumber(0);
        }

        int x = Conversions.toInt32(args[0]);
        int y = args.length < 2 ? 0 : Conversions.toInt32(args[1]);
        return ScriptRuntime.toNumber(x * y);
    }