Bug 75880 – IndexedDB: Negative zero not round-tripped as a value

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

[Joshua Bell]

Repro:

var negative_zero = -0;
function is_negative_zero() { return x === 0 && 1/x === -Infinity; }
var request = store.put(negative_zero, "neg_zero");
request.onsuccess = function () {
    request = store.get("neg_zero");
    request.onsuccess = function () {
        ASSERT(is_negative_zero(request.result));
    };
};

Reason:

In the V8 implementation of SerializedScriptValue, Int32s are serialized in a more efficient way than other numbers (which are serialized as doubles). The test calls v8::Value::IsInt32() which returns true for -0. When serialized/deserialized, this turns into plain old 0.

Either v8::Value::IsInt32() (and Uint32) should be changed or a special case should be added to SerializedScriptValue.

[Joshua Bell]

This was acknowledged as a v8 bug and fixed in http://code.google.com/p/v8/source/detail?r=10361

This should be fixed when the chromium port rolls that revision.

[Joshua Bell]

The V8 patch landed, and local testing confirms the fix.

The layout test in https://bugs.webkit.org/show_bug.cgi?id=74897 covers this case, and I should land that soon.