1247275 - LookupDtoaCache conflates 0 and -0, thus conflating property names "0" and "-0"

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Lars T Hansen [:lth]]

LookupDtoaCache conflates 0 and -0.  So far as I can tell, this will affect the correctness of js::ToAtom and js::ValueToId.

This is in connection with the CanonicalNumericIndexString() algorithm in ES6, which handles -0 specially: http://www.ecma-international.org/ecma-262/6.0/#sec-canonicalnumericindexstring

We can see this in the current JS shell in several places, but here's one:

js> ["hi"].hasOwnProperty(0)
true
js> ["hi"].hasOwnProperty(0/-1)
true

The last uses the property name "-0".  I'm pretty sure the answer should be false, by 3.c.iv here: http://www.ecma-international.org/ecma-262/6.0/#sec-integer-indexed-exotic-objects-hasproperty-p

Comment 1

[Lars T Hansen [:lth]]

Although I note that both Chrome 50 and Safari 9.0.3 also print "true" for the last case.

Comment 2

[Lars T Hansen [:lth]]

Having looked at this some more I don't think this is a problem for ToAtom and ValueToId: for property names, -0 and 0 should be treated the same.