Panic: i32::MIN % -1 remainder overflow

[domenukk]

Describe the bug
Panic / Unreachable when running

(-2147483648 | 0) % (-1 | 0)

Expected behavior
Not crash

boa_engine-0.21.1/src/value/operations.rs:157

// Line 150-161:
pub fn rem(&self, other: &Self, context: &mut Context) -> JsResult<Self> {
    Ok(match (self.variant(), other.variant()) {
        // Fast path:
        (JsVariant::Integer32(x), JsVariant::Integer32(y)) => {
            if y == 0 {
                Self::nan()
            } else {
                match x % y {  // ← LINE 157: PANICS when x=i32::MIN, y=-1
                    rem if rem == 0 && x < 0 => Self::new(-0.0),
                    rem => Self::new(rem),
                }
            }
        }

[r4-rahul123]

Hi, I'd like to work on this.
Can you assign #5481 to me?
Plan: fix wrapping_rem at operations.rs:157,757 and checked_neg at :502.

[Jayesh-Dev21]

Hello Maintainers!
New contributor here, done with setting up the project and excited to start exploring the Boa codebase.
I've used Boa in a few projects for the WebAssembly part and have been wanting to contribute for a while.

I did a little digging into this and confirmed the bug. The panic comes from two unchecked i32 remainder operations in core/engine/src/value/operations.rs:

1. rem() at line 157 - bare x % y panics when x = i32::MIN, y = -1 (signed integer overflow)
2. rem_fast() at line 757 - same bare x % y in the fast-path variant

Both are triggered by (-2147483648 | 0) % (-1 | 0).

---

Planned fix: Replace x % y with x.checked_rem(y), falling back to f64 arithmetic on overflow; the same pattern is already used by add, sub, mul, and div in the same file. I'll also add a regression test.

Expected result (verified against Node.js): -0

Will open a PR if this looks good, THanks