Bug 878510: IonMonkey: Arm: Test for negative zero instead of zero when converting doubles to integers, r=mjrosenb

js/src/ion/arm/MacroAssembler-arm.cpp

@@ -94,11 +94,15 @@ MacroAssemblerARM::convertDoubleToInt32(const FloatRegister &src, const Register
     ma_vcmp(src, ScratchFloatReg);
     as_vmrs(pc);
     ma_b(fail, Assembler::VFP_NotEqualOrUnordered);
-    // If they're equal, test for 0.  It would be nicer to test for -0.0 explicitly, but that seems hard.
+
     if (negativeZeroCheck) {
         ma_cmp(dest, Imm32(0));
+        // Test and bail for -0.0, when integer result is 0
+        // Move the top word of the double into the output reg, if it is non-zero,
+        // then the original value was -0.0
+        as_vxfer(dest, InvalidReg, src, FloatToCore, Assembler::Equal, 1);
+        ma_cmp(dest, Imm32(0x80000000), Assembler::Equal);
         ma_b(fail, Assembler::Equal);
-        // guard for != 0.
     }
 }
 

js/src/jit-test/tests/ion/bug878510.js

@@ -0,0 +1,20 @@
+function neg0(x) {
+  return x===0 && (1/x)===-Infinity;
+}
+
+function test(x,y) {
+  if (x == 1.1)
+    return 0;
+  else if (x == "a")
+    return 0;
+  return x*y
+}
+
+var t = 0;
+for(var i=0; i<1005; i++) {
+  test(1.1)
+  test("a")
+  t = test((i<1003)?i:-0, 0);
+}
+
+assertEq(neg0(t), true);