Convert negative zero in ArraySpeciesCreate

test/mjsunit/es6/array-species-neg-zero.js

Index: test/mjsunit/es6/array-species-neg-zero.js
diff --git a/test/mjsunit/es6/array-species-neg-zero.js b/test/mjsunit/es6/array-species-neg-zero.js
new file mode 100644
index 0000000000000000000000000000000000000000..d60b8ba00f6f42d98cb57e98159ed57441db24b3
--- /dev/null
+++ b/test/mjsunit/es6/array-species-neg-zero.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * 9.4.2.3 ArraySpeciesCreate(originalArray, length)
+ *
+ * 1. Assert: length is an integer Number ≥ 0.
+ * 2. If length is −0, let length be +0.
+ * [...]
+ */
+
+var x = [];
+var deleteCount;
+
+x.constructor = function() {};
+x.constructor[Symbol.species] = function(param) {
+  deleteCount = param;
+};
+
+x.splice(0, -0);
+
+assertEquals(0, deleteCount);