Negative zero broken on ≥ v10.4.0

[TimothyGu]

• Version: ≥ v10.4.0 < v12.0.0
• Platform: Linux 4.9.0-8-amd64 SMP Debian 4.9.130-2 (2018-10-27) x86_64 GNU/Linux
• Subsystem: v8

V8 versions between 6.7 and 7.0 (inclusive) have a bug where

[...[]];
console.log(Object.is(-0, 0));

prints true rather than false. This is reproducible with all Node.js versions after 10.4.0, though it is fixed on master which uses V8 7.1. We should find the V8 commit that fixes this and backport it to LTS at the very least.

/cc @devsnek, who helped triage this bug
/cc @nodejs/v8

[devsnek]

to be clear, the issue is that -0 evaluates to 0, it's not a bug with Object.is or console.log.

[bnoordhuis]

If it helps, this bug seems to persist after the function is optimized by TurboFan and therefore it's likely not an Ignition bug.

[ryzokuken]

@TimothyGu this seems to be fixed on v11.5.0 as well:

> $ node -v
v11.5.0

> $ node -e "console.log(Object.is(-0, 0))"
false

[TimothyGu]

@ryzokuken You have to use the spread operator prior to the evaluation of -0 to make the bug surface.

[ryzokuken]

@TimothyGu I'd already tried that:

I see. Will try to investigate.

> $ node 
> [...[]]; console.log(Object.is(-0, 0));
true
undefined

[targos]

This was fixed as a side-effect in v8/v8@1c48d52.

That's a big change that we probably won't be able to backport.

[BridgeAR]

@targos there do not seem to be a lot of conflicts in that commit when backprorting it to v11.

@nodejs/v8 @psmarshall @bmeurer @hashseed would you be so kind and check what is required to backport the necessary commit?