BigInteger correctness regression from .NET 8

[hez2010]

Description

BigInteger produces incorrect results in .NET 9, while this doesn't repro with .NET 8 or earlier.

Reproduction Steps

Console.WriteLine(new BigInteger(-4294967296) & new BigInteger(-1919810));
Console.WriteLine(new BigInteger(-4042322161) & new BigInteger(-252645136));
Console.WriteLine(new BigInteger(-8589934592) | new BigInteger(-21474836480));

Console.WriteLine(BigInteger.Parse("-4294967296") & BigInteger.Parse("-1919810"));
Console.WriteLine(BigInteger.Parse("-4042322161") & BigInteger.Parse("-252645136"));
Console.WriteLine(BigInteger.Parse("-8589934592") | BigInteger.Parse("-21474836480"));

Expected behavior

-4294967296
-4294967296
-4294967296
-4294967296
-4294967296
-4294967296

Actual behavior

0
0
0
0
0
0

Regression?

Yes

Known Workarounds

No

Configuration

.NET 9 rc2

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-numerics
See info in area-owners.md if you want to be subscribed.

[tannergooding]

Bug looks to be in the internal span constructor and sign preservation being incorrectly tracked as false.

[jeffhandley]

Thanks for reporting this, @hez2010. We will fix this and backport into 9.0 servicing.

@tannergooding Do you think this is limited to a small domain of values? We will need to prepare a Known Issues entry on https://github.com/dotnet/core/blob/main/release-notes/9.0/known-issues.md for this.

[Rob-Hague]

In my understanding, it affects the operators &, |, ^ whose result is a negative number of the form -2^(32n), n>1. In other words, whose result is 0xFFFFFFFF 00000000 ... 00000000 for any positive number of trailing zero blocks, such that the length of the two's complement of this value is greater than the number of trailing zero blocks.

An assert can fire for values with nonzero trailing blocks, but it does not result in correctness issues. But for the affected values, it can also give rise to an exception when formatting, because of invalid internal state e.g.

BigInteger a = new BigInteger(MemoryMarshal.AsBytes([uint.MaxValue, 0u, 0u]), isBigEndian: true);

BigInteger or = a | a;

Console.WriteLine(or == a); // False (should be True)

Console.WriteLine(or); // System.IndexOutOfRangeException: Index was outside the bounds of the array.
//    at System.Number.FormatBigInteger(Boolean targetSpan, BigInteger value, String formatString, ReadOnlySpan`1 formatSpan, NumberFormatInfo info, Span`1 destination, Int32& charsWritten, Boolean& spanSuccess)
//    at System.Number.FormatBigInteger(BigInteger value, String format, NumberFormatInfo info)
//    at System.Numerics.BigInteger.ToString()

[huoyaoyuan]

The fix was already submitted at #105456