[asm.js] Force -0 to be double

This adjusts parsing of negative numbers in UnaryExpression and
MultiplicativeExpression to return double if the token is -0.

R=clemensb@chromium.org
TEST=mjsunit/regress/regress-6838-4
BUG=v8:6838

Change-Id: I6c2113b520c3831f4a5101f0a963f49c1eb9d7d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2007272Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65862}

src/asmjs/asm-parser.cc

@@ -1581,14 +1581,17 @@ AsmType* AsmJsParser::UnaryExpression() {
   if (Check('-')) {
     uint32_t uvalue;
     if (CheckForUnsigned(&uvalue)) {
-      // TODO(bradnelson): was supposed to be 0x7FFFFFFF, check errata.
-      if (uvalue <= 0x80000000) {
+      if (uvalue == 0) {
+        current_function_builder_->EmitF64Const(-0.0);
+        ret = AsmType::Double();
+      } else if (uvalue <= 0x80000000) {
+        // TODO(bradnelson): was supposed to be 0x7FFFFFFF, check errata.
         current_function_builder_->EmitI32Const(
             base::NegateWithWraparound(static_cast<int32_t>(uvalue)));
+        ret = AsmType::Signed();
       } else {
         FAILn("Integer numeric literal out of range.");
       }
-      ret = AsmType::Signed();
     } else {
       RECURSEn(ret = UnaryExpression());
       if (ret->IsA(AsmType::Int())) {
@@ -1680,7 +1683,7 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
       RECURSEn(a = UnaryExpression());
     }
   } else if (Check('-')) {
-    if (CheckForUnsignedBelow(0x100000, &uvalue)) {
+    if (!PeekForZero() && CheckForUnsignedBelow(0x100000, &uvalue)) {
       int32_t value = -static_cast<int32_t>(uvalue);
       current_function_builder_->EmitI32Const(value);
       if (Check('*')) {
@@ -1704,7 +1707,7 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
     if (Check('*')) {
       uint32_t uvalue;
       if (Check('-')) {
-        if (CheckForUnsigned(&uvalue)) {
+        if (!PeekForZero() && CheckForUnsigned(&uvalue)) {
           if (uvalue >= 0x100000) {
             FAILn("Constant multiple out of range");
           }

src/asmjs/asm-parser.h

@@ -250,6 +250,10 @@ class AsmJsParser {
     return scanner_.Token() == token;
   }
 
+  inline bool PeekForZero() {
+    return (scanner_.IsUnsigned() && scanner_.AsUnsigned() == 0);
+  }
+
   inline bool Check(AsmJsScanner::token_t token) {
     if (scanner_.Token() == token) {
       scanner_.Next();

test/mjsunit/mjsunit.status

@@ -330,6 +330,7 @@
   'regress/regress-6700': [SKIP],
   'regress/regress-6838-2': [SKIP],
   'regress/regress-6838-3': [SKIP],
+  'regress/regress-6838-4': [SKIP],
   'regress/regress-9022': [SKIP],
   'regress/regress-9832': [SKIP],
   'regress/regress-crbug-934138': [SKIP],

test/mjsunit/regress/regress-6838-4.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMinusZeroIsDouble() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / +-0;
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleBracketed() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultDouble1() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0 * 1.0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultDouble2() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (1.0 * -0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultInt() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0 * 1);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertFalse(%IsAsmWasmCode(Module));
+})();