From 754a47b63b70b8c6d70629036c4e16267c1d4d19 Mon Sep 17 00:00:00 2001
From: lichenshuai <lichenshuai@huawei.com>
Date: Thu, 1 Jun 2023 11:40:27 +0800
Subject: [PATCH] Fix Multiplication -0 Bug

Fix the case when a negative number multiplies with 0.

Issue: #I79Y5V

Signed-off-by: lichenshuai <lichenshuai@huawei.com>
Change-Id: Icbbd9dad0402441d281301b9bff6bfa1e4771ea1
---
 ecmascript/compiler/stub_builder.cpp       | 25 +++++++++++++++++++---
 ecmascript/js_tagged_number.h              |  3 +++
 test/moduletest/builtins/builtinsnumber.js |  1 +
 test/moduletest/builtins/expect_output.txt |  1 +
 4 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/ecmascript/compiler/stub_builder.cpp b/ecmascript/compiler/stub_builder.cpp
index cde15373e0..e218bea4ce 100644
--- a/ecmascript/compiler/stub_builder.cpp
+++ b/ecmascript/compiler/stub_builder.cpp
@@ -4201,9 +4201,28 @@ GateRef StubBuilder::FastAddSubAndMul(GateRef left, GateRef right, ProfileOperat
         }
         Bind(&notOverflow);
         {
-            result = IntToTaggedPtr(TruncInt64ToInt32(res));
-            TYPE_CALL_BACK(PGOSampleType::Type::INT)
-            Jump(&exit);
+            if (Op == OpCode::MUL) {
+                Label resultIsZero(env);
+                Label returnNegativeZero(env);
+                Label returnResult(env);
+                Branch(Int64Equal(res, Int64(0)), &resultIsZero, &returnResult);
+                Bind(&resultIsZero);
+                GateRef leftNegative = Int32LessThan(GetInt32OfTInt(left), Int32(0));
+                GateRef rightNegative = Int32LessThan(GetInt32OfTInt(right), Int32(0));
+                Branch(BoolOr(leftNegative, rightNegative), &returnNegativeZero, &returnResult);
+                Bind(&returnNegativeZero);
+                result = DoubleToTaggedDoublePtr(Double(-0.0));
+                TYPE_CALL_BACK(PGOSampleType::Type::DOUBLE)
+                Jump(&exit);
+                Bind(&returnResult);
+                result = IntToTaggedPtr(TruncInt64ToInt32(res));
+                TYPE_CALL_BACK(PGOSampleType::Type::INT)
+                Jump(&exit);
+            } else {
+                result = IntToTaggedPtr(TruncInt64ToInt32(res));
+                TYPE_CALL_BACK(PGOSampleType::Type::INT)
+                Jump(&exit);
+            }
         }
         Bind(&exit);
         auto ret = *result;
diff --git a/ecmascript/js_tagged_number.h b/ecmascript/js_tagged_number.h
index 00c31fd1b8..c74f654008 100644
--- a/ecmascript/js_tagged_number.h
+++ b/ecmascript/js_tagged_number.h
@@ -112,6 +112,9 @@ public:
             if (res > INT32_MAX || res < INT32_MIN) {
                 return JSTaggedNumber(static_cast<double>(res));
             }
+            if (res == 0 && (intA < 0 || intB < 0)) {
+                return JSTaggedNumber(-0.0);
+            }
             return JSTaggedNumber(static_cast<int>(res));
         }
         return JSTaggedNumber(GetNumber() * number.GetNumber());
diff --git a/test/moduletest/builtins/builtinsnumber.js b/test/moduletest/builtins/builtinsnumber.js
index 26274342ee..26c58e6acd 100644
--- a/test/moduletest/builtins/builtinsnumber.js
+++ b/test/moduletest/builtins/builtinsnumber.js
@@ -23,4 +23,5 @@ let result = Number.parseInt("16947500000");
 print("builtins number start");
 print("parseInt result = " + result);
 print(1 / 0.75 * 0.6);
+print(1 / (-1 * 0));
 print("builtins number end");
diff --git a/test/moduletest/builtins/expect_output.txt b/test/moduletest/builtins/expect_output.txt
index f2bdaf67eb..91804e8fc5 100644
--- a/test/moduletest/builtins/expect_output.txt
+++ b/test/moduletest/builtins/expect_output.txt
@@ -36,6 +36,7 @@ builtins ir end
 builtins number start
 parseInt result = 16947500000
 0.7999999999999999
+-Infinity
 builtins number end
 builtins regexp start
 20210608_5V0J5lVh4xVNYx0AUE.jpg,.jpg