Preserve -0 in integer multiplication fast paths

[lahma]

Spec bug in the integer-operand fast paths of multiplication: Number::multiply gives a negative-signed zero when a zero product's operand signs differ — Object.is(0 * -5, -0) must be true — but both binary * (TimesBinaryExpression) and compound *= (ComputeCompound) computed integer products in long arithmetic, where the sign of zero cannot be represented, and returned +0:

var zero = 0, negFive = -5;
Object.is(zero * negFive, -0);   // main: false — spec/V8: true
var acc = 0; acc *= -5;
Object.is(acc, -0);              // main: false — spec/V8: true

Literal forms (0 * -5 with both operands literal) were unaffected because constant folding already runs on doubles — which is why Test262's multiplication suites (literal-shaped) never caught it; any runtime integer operands (slots, array elements, properties, call results) hit the bug.

The fix

Compute the long product first; a nonzero product keeps the exact integer path unchanged, a zero product re-derives the result via double multiplication to pick up the sign rule. Zero products are rare in numeric loops, so the extra branch sits on a cold edge.

Audit of the other AreIntegerOperands fast paths: Remainder and DivideInteger already handle their -0 cases explicitly; integer addition/subtraction cannot produce -0 (integer-typed operands can't hold -0, and x + (−x) / x − x are +0 per spec); bitwise ops are ToInt32-domain. Only the two multiplication sites were affected.

Benchmarks

The integer multiply path is hot in numeric workloads — guard A/B (stash-pair, one window):

DromaeoBenchmark Cube (multiply-heavy) at --launchCount 5 (the single-launch run showed a +12.9% swing on one Cube row alongside a −15% swing on another — the classic code-layout signature for these InvocationCount=1 rows, so the decision runs on multi-launch medians):

Row	main (median)	PR (median)	Δ	Allocated
Cube classic, source	8.739 ms	8.456 ms	−3.2%	1.59 MB (=)
Cube classic, prepared	6.945 ms	6.996 ms	+0.7%	1.31 MB (=)
Cube modern, source	7.799 ms	7.966 ms	+2.1%	1.59 MB (=)
Cube modern, prepared	7.190 ms	7.104 ms	−1.2%	1.3 MB (=)

ObjectArray (integer-arithmetic-heavy, single launch): all four variants within ±3% both directions, allocations byte-identical. Mixed signs inside the documented noise band on every row — the zero-product branch is perf-neutral, as expected for a predicted-not-taken edge.

Tests

New NumberTests.IntegerMultiplicationPreservesNegativeZero pins 11 shapes: slot × slot both orders, positive/zero controls, literal form, array elements, object properties, function returns, and compound *= in three sign combinations.

Full gate: Jint/Jint.csproj all TFMs, Jint.Tests (net10.0 + net472), Jint.Tests.PublicInterface (net10.0 + net472), full Test262.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BY8HoKam5H8vTPn1bMY2Hv