tor-browser

commit 6eea065a3b9c8dd1a7fbc716f9ff67db393f4413
parent a9f1ef583da50ecfa2344c85617b30ec84e21e8a
Author: Ryan Hunt <rhunt@eqrion.net>
Date:   Fri, 12 Dec 2025 20:49:59 +0000

Bug 1992240 - wasm: Revert Bug 1977692. r=bvisness

This reverts commit 1289cf86f68575fb4f9fc31a0f68117a2376099a.

Differential Revision: https://phabricator.services.mozilla.com/D275281

Diffstat:
M
js/src/jit-test/lib/wasm.js
 | 
1
+
M
js/src/jit-test/tests/wasm/gc/i31ref.js
 | 
17
+++++------------
M
js/src/jit/MacroAssembler.cpp
 | 
6
++----
M
js/src/wasm/WasmAnyRef.cpp
 | 
2
+-

4 files changed, 9 insertions(+), 17 deletions(-)
diff --git a/js/src/jit-test/lib/wasm.js b/js/src/jit-test/lib/wasm.js
@@ -488,6 +488,7 @@ let WasmNonAnyrefValues = [
     {x:1337},
     ["abracadabra"],
     13.37,
+    -0,
     0x7fffffff + 0.1,
     -0x7fffffff - 0.1,
     0x80000000 + 0.1,
diff --git a/js/src/jit-test/tests/wasm/gc/i31ref.js b/js/src/jit-test/tests/wasm/gc/i31ref.js
@@ -1,9 +1,3 @@
-// -0 is a valid value with which to create an i31ref, but because it
-// roundtrips to +0, it wrecks a lot of our WASM tests (which use Object.is for
-// comparison). Therefore we don't include -0 in the main list, and deal with
-// that complexity in this file specifically.
-WasmI31refValues.push(-0);
-
 let InvalidI31Values = [
   null,
   Number.EPSILON,
@@ -11,9 +5,8 @@ let InvalidI31Values = [
   Number.MIN_SAFE_INTEGER,
   Number.MIN_VALUE,
   Number.MAX_VALUE,
-  Infinity,
-  -Infinity,
   Number.NaN,
+  -0,
   // Number objects are not coerced
   ...WasmI31refValues.map(n => new Number(n)),
   // Non-integers are not valid
@@ -102,16 +95,16 @@ for (let i of InvalidI31Values) {
 // Test that we can roundtrip 31-bit integers through the i31ref type
 // faithfully.
 for (let i of WasmI31refValues) {
-  assertEq(refI31(i), Object.is(i, -0) ? 0 : i);
-  assertEq(refI31Identity(i), Object.is(i, -0) ? 0 : i);
+  assertEq(refI31(i), i);
+  assertEq(refI31Identity(i), i);
   assertEq(i31GetU(i), valueAsI31GetU(i));
-  assertEq(i31GetS(i), Object.is(i, -0) ? 0 : i);
+  assertEq(i31GetS(i), i);
 }
 
 // Test that i31ref values are truncated when given a 32-bit value
 for (let i of WasmI31refValues) {
   let adjusted = i | 0x80000000;
-  assertEq(refI31(adjusted), Object.is(i, -0) ? 0 : i);
+  assertEq(refI31(adjusted), i);
 }
 
 // Test that comparing identical i31 values works
diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
@@ -7467,8 +7467,7 @@ void MacroAssembler::branchValueConvertsToWasmAnyRefInline(
   bind(&checkDouble);
   {
     unboxDouble(src, scratchFloat);
-    convertDoubleToInt32(scratchFloat, scratchInt, &fallthrough,
-                         /*negativeZeroCheck=*/false);
+    convertDoubleToInt32(scratchFloat, scratchInt, &fallthrough);
     branch32(Assembler::GreaterThan, scratchInt,
              Imm32(wasm::AnyRef::MaxI31Value), &fallthrough);
     branch32(Assembler::LessThan, scratchInt, Imm32(wasm::AnyRef::MinI31Value),
@@ -7497,8 +7496,7 @@ void MacroAssembler::convertValueToWasmAnyRef(ValueOperand src, Register dest,
   bind(&doubleValue);
   {
     unboxDouble(src, scratchFloat);
-    convertDoubleToInt32(scratchFloat, dest, oolConvert,
-                         /*negativeZeroCheck=*/false);
+    convertDoubleToInt32(scratchFloat, dest, oolConvert);
     branch32(Assembler::GreaterThan, dest, Imm32(wasm::AnyRef::MaxI31Value),
              oolConvert);
     branch32(Assembler::LessThan, dest, Imm32(wasm::AnyRef::MinI31Value),
diff --git a/js/src/wasm/WasmAnyRef.cpp b/js/src/wasm/WasmAnyRef.cpp
@@ -86,7 +86,7 @@ bool AnyRef::fromJSValue(JSContext* cx, HandleValue value,
   if (value.isDouble()) {
     double doubleValue = value.toDouble();
     int32_t intValue;
-    if (mozilla::NumberEqualsInt32(doubleValue, &intValue) &&
+    if (mozilla::NumberIsInt32(doubleValue, &intValue) &&
         !int32NeedsBoxing(intValue)) {
       result.set(AnyRef::fromInt32(intValue));
       return true;