[Nussu06]

fmtDouble and the Round branch in ImportProject::applyMSBuildStaticFunction cast the double result of a System.Math property function to long long without a range check, so a project value like $([System.Math]::Pow(10,30)) or $([System.Math]::Round(1e30)) is undefined behaviour (UBSan float-cast-overflow, as noted in the AI review on #8938). fmtDouble now takes the integer path only when the value fits in long long, and Round does its half-to-even step in double and formats through fmtDouble, so in-range results are unchanged and Round(1e30) gives the same text as Pow(10,30) instead of LLONG_MIN (out-of-range values still print via std::to_string rather than MSBuild's 1E+30, which is left for a separate change). Tested with new asserts in testMSBuildStaticFunctions, the full testrunner, and cppcheck --project on a crafted vcxproj with a UBSan build. I don't have Trac access, so could you create a ticket for this one?

[dmcppcheck]

There should probably be a trac ticket for this PR. Please create it, or ask us to create it. Then the PR title should be updated.

[dmcppcheck]

Test results for commit d5402d8 (tools/test-my-pr.py, main compared to this PR):

Test: http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8950/
packages: 100
Differing warnings: 0 (+0 -0)
Timing: +0.4% (http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8950/2026-10-21_11-44-45-d5402d82da5e_timing.html)

_{Posted automatically by the cppcheck PR test runner. +N: warnings only with this PR, -N: warnings only with main. The AI review is written by Claude and can be wrong.}

[dmcppcheck]

AI review

I found no new problems. The range check in fmtDouble is correct: [LLONG_MIN, 2^63) is exactly the set of doubles that convert to long long without undefined behaviour, and NaN fails the check, so it falls through to std::to_string. Round now does its banker's rounding in double, so it no longer casts at all. Its in-range results match the old code, including the negative half cases, -0.5 → 0 and values next to 2^52. LLONG_MIN is already used elsewhere in this file, so the change adds no new include dependency.

Testing

• I built cppcheck and testrunner in pr/ with make -j8, and both built cleanly.

• ./testrunner TestImportProject: 0 failures, including the new asserts for Round, Pow and Floor.

• I copied the new fmtDouble and Round logic into scratch/t.cpp and built it with g++ -fsanitize=undefined,float-cast-overflow -fno-sanitize-recover=all. I ran it on these inputs:

  • the values around ±2^63 (9223372036854775807, 9223372036854775808, -9223372036854775808, -9223372036854775809), -9.3e18 and 1e300
  • nan, inf, -inf and -0.0
  • the half cases ±0.5, ±1.5, -2.5 and ±4503599627370495.5
  • 0.49999999999999994

  UBSan reported nothing. All results were what I expected: integer text inside the range, std::to_string text outside it, and round-half-to-even for the half cases.

• I did not repeat the cppcheck --project run on a crafted vcxproj that the description mentions.

---

Automated review of d5402d8 by Claude. The pull request was built and tested locally.