Convert negative zero in ArraySpeciesCreate

As per the ES2015 spec, the value `-0` should be converted to `+0` prior
to invocation of the species constructor.

BUG=v8:4988
LOG=N
R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/1950073002
Cr-Commit-Position: refs/heads/master@{#36045}

src/js/array.js

@@ -43,6 +43,9 @@ utils.ImportFromExperimental(function(from) {
 
 function ArraySpeciesCreate(array, length) {
   var constructor;
+
+  length = INVERT_NEG_ZERO(length);
+
   if (FLAG_harmony_species) {
     constructor = %ArraySpeciesConstructor(array);
   } else {
@@ -1193,7 +1196,7 @@ function InnerArrayIndexOf(array, element, index, length) {
   if (IS_UNDEFINED(index)) {
     index = 0;
   } else {
-    index = TO_INTEGER(index) + 0;  // Add 0 to convert -0 to 0
+    index = INVERT_NEG_ZERO(TO_INTEGER(index));
     // If index is negative, index from the end of the array.
     if (index < 0) {
       index = length + index;
@@ -1255,7 +1258,7 @@ function InnerArrayLastIndexOf(array, element, index, length, argumentsLength) {
   if (argumentsLength < 2) {
     index = length - 1;
   } else {
-    index = TO_INTEGER(index) + 0;  // Add 0 to convert -0 to 0
+    index = INVERT_NEG_ZERO(TO_INTEGER(index));
     // If index is negative, index from end of the array.
     if (index < 0) index += length;
     // If index is still negative, do not search the array.

src/js/macros.py

@@ -113,6 +113,7 @@ macro TO_INTEGER(arg) = (%_ToInteger(arg));
 macro TO_INTEGER_MAP_MINUS_ZERO(arg) = (%_IsSmi(%IS_VAR(arg)) ? arg : %NumberToIntegerMapMinusZero(arg));
 macro TO_INT32(arg) = ((arg) | 0);
 macro TO_UINT32(arg) = ((arg) >>> 0);
+macro INVERT_NEG_ZERO(arg) = ((arg) + 0);
 macro TO_LENGTH(arg) = (%_ToLength(arg));
 macro TO_STRING(arg) = (%_ToString(arg));
 macro TO_NUMBER(arg) = (%_ToNumber(arg));

test/mjsunit/es6/array-species-neg-zero.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * 9.4.2.3 ArraySpeciesCreate(originalArray, length)
+ *
+ * 1. Assert: length is an integer Number ≥ 0.
+ * 2. If length is −0, let length be +0.
+ * [...]
+ */
+
+var x = [];
+var deleteCount;
+
+x.constructor = function() {};
+x.constructor[Symbol.species] = function(param) {
+  deleteCount = param;
+};
+
+x.splice(0, -0);
+
+assertEquals(0, deleteCount);