From a87614644969a3909980eb5f2ba5fc31e421c268 Mon Sep 17 00:00:00 2001
From: Jakob Kummerow <jkummerow@chromium.org>
Date: Mon, 2 Aug 2021 11:56:13 +0200
Subject: [PATCH] [bigint] Fix accidental creation of "minus zero" BigInts

Regressed in crrev.com/152ecad8cd4d170e4091a79eaa8d70d10d94734d.

Fixed: chromium:1234931
Change-Id: I8f2b603a914fccaeaeb3dcffa63070cf8fb6f0e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3064604
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76033}
---
 src/objects/bigint.cc                         |  2 +-
 .../harmony/bigint/regress-minuszero.js       | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 test/mjsunit/harmony/bigint/regress-minuszero.js

diff --git a/src/objects/bigint.cc b/src/objects/bigint.cc
index 5e0922dc6d..5d21adfb89 100644
--- a/src/objects/bigint.cc
+++ b/src/objects/bigint.cc
@@ -1560,7 +1560,7 @@ MaybeHandle<BigInt> BigInt::Allocate(IsolateT* isolate,
     Terminate(isolate);
     return {};
   }
-  result->set_sign(negative);
+  if (digits > 0) result->set_sign(negative);
   return MutableBigInt::MakeImmutable(result);
 }
 template MaybeHandle<BigInt> BigInt::Allocate(Isolate*,
diff --git a/test/mjsunit/harmony/bigint/regress-minuszero.js b/test/mjsunit/harmony/bigint/regress-minuszero.js
new file mode 100644
index 0000000000..164e08d616
--- /dev/null
+++ b/test/mjsunit/harmony/bigint/regress-minuszero.js
@@ -0,0 +1,25 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertTrue(BigInt("-0 ") == -0);
+assertTrue("-0 " == 0n);
+assertTrue(BigInt("-0") == -0);
+assertTrue(-0n == -0);
+assertTrue(-0n == 0n);
+
+assertTrue(BigInt("-0 ") > -1);
+assertTrue("-0 " > -1n);
+assertTrue(BigInt("-0") > -1);
+assertTrue(-0n > -1);
+
+assertEquals(BigInt("-0 ") & 1n, 0n);
+assertEquals(BigInt("-0") & 1n, 0n);
+assertEquals(-0n & 1n, 0n);
+
+var zero = BigInt("-0 ");
+assertEquals(1n, ++zero);
+zero = BigInt("-0");
+assertEquals(1n, ++zero);
+zero = -0n;
+assertEquals(1n, ++zero);