Bug 1977692: Allow -0 to convert to i31ref. r=rhunt

This required changing the C++ conversion path (deep in
ToWebAssemblyValue) and the JIT entry path.

Differential Revision: https://phabricator.services.mozilla.com/D258039

Author: bvisness

js/src/jit-test/lib/wasm.js

@@ -488,7 +488,6 @@ let WasmNonAnyrefValues = [
     {x:1337},
     ["abracadabra"],
     13.37,
-    -0,
     0x7fffffff + 0.1,
     -0x7fffffff - 0.1,
     0x80000000 + 0.1,

js/src/jit-test/tests/wasm/gc/i31ref.js

@@ -1,12 +1,19 @@
+// -0 is a valid value with which to create an i31ref, but because it
+// roundtrips to +0, it wrecks a lot of our WASM tests (which use Object.is for
+// comparison). Therefore we don't include -0 in the main list, and deal with
+// that complexity in this file specifically.
+WasmI31refValues.push(-0);
+
 let InvalidI31Values = [
   null,
   Number.EPSILON,
   Number.MAX_SAFE_INTEGER,
   Number.MIN_SAFE_INTEGER,
   Number.MIN_VALUE,
   Number.MAX_VALUE,
+  Infinity,
+  -Infinity,
   Number.NaN,
-  -0,
   // Number objects are not coerced
   ...WasmI31refValues.map(n => new Number(n)),
   // Non-integers are not valid
@@ -95,16 +102,16 @@ for (let i of InvalidI31Values) {
 // Test that we can roundtrip 31-bit integers through the i31ref type
 // faithfully.
 for (let i of WasmI31refValues) {
-  assertEq(refI31(i), i);
-  assertEq(refI31Identity(i), i);
+  assertEq(refI31(i), Object.is(i, -0) ? 0 : i);
+  assertEq(refI31Identity(i), Object.is(i, -0) ? 0 : i);
   assertEq(i31GetU(i), valueAsI31GetU(i));
-  assertEq(i31GetS(i), i);
+  assertEq(i31GetS(i), Object.is(i, -0) ? 0 : i);
 }
 
 // Test that i31ref values are truncated when given a 32-bit value
 for (let i of WasmI31refValues) {
   let adjusted = i | 0x80000000;
-  assertEq(refI31(adjusted), i);
+  assertEq(refI31(adjusted), Object.is(i, -0) ? 0 : i);
 }
 
 // Test that comparing identical i31 values works

js/src/jit/MacroAssembler.cpp

@@ -7187,7 +7187,8 @@ void MacroAssembler::branchValueConvertsToWasmAnyRefInline(
   bind(&checkDouble);
   {
     unboxDouble(src, scratchFloat);
-    convertDoubleToInt32(scratchFloat, scratchInt, &fallthrough);
+    convertDoubleToInt32(scratchFloat, scratchInt, &fallthrough,
+                         /*negativeZeroCheck=*/false);
     branch32(Assembler::GreaterThan, scratchInt,
              Imm32(wasm::AnyRef::MaxI31Value), &fallthrough);
     branch32(Assembler::LessThan, scratchInt, Imm32(wasm::AnyRef::MinI31Value),
@@ -7216,7 +7217,8 @@ void MacroAssembler::convertValueToWasmAnyRef(ValueOperand src, Register dest,
   bind(&doubleValue);
   {
     unboxDouble(src, scratchFloat);
-    convertDoubleToInt32(scratchFloat, dest, oolConvert);
+    convertDoubleToInt32(scratchFloat, dest, oolConvert,
+                         /*negativeZeroCheck=*/false);
     branch32(Assembler::GreaterThan, dest, Imm32(wasm::AnyRef::MaxI31Value),
              oolConvert);
     branch32(Assembler::LessThan, dest, Imm32(wasm::AnyRef::MinI31Value),

js/src/wasm/WasmAnyRef.cpp

@@ -86,7 +86,7 @@ bool AnyRef::fromJSValue(JSContext* cx, HandleValue value,
   if (value.isDouble()) {
     double doubleValue = value.toDouble();
     int32_t intValue;
-    if (mozilla::NumberIsInt32(doubleValue, &intValue) &&
+    if (mozilla::NumberEqualsInt32(doubleValue, &intValue) &&
         !int32NeedsBoxing(intValue)) {
       result.set(AnyRef::fromInt32(intValue));
       return true;