fix(json): preserve -0 sign and stop panicking on lone-surrogate strings

Two parser bugs found by adversarial QuickCheck testing:

- #4049: parse aborted (panic, not ParseError) on strings that mix a
  raw lone trailing surrogate with any escape sequence, e.g. the
  5-code-unit text " U+DC00 \n ": lex_string_slow's flush sliced with
  the checked ctx.input[start:end], which aborts when the code unit at
  a boundary is a trailing surrogate. Use view(start_offset~,
  end_offset~) (bounds checks only), matching the fast path in
  lex_string, so such strings parse successfully instead of crashing
  the process.

- #4053: parse("-0") returned +0.0 while parse("-0.0") / parse("-0e0")
  returned -0.0: the integer fast path in lex_number_end negated the
  mantissa as an Int64 (where -0 == 0) before converting to Double.
  Negate after the conversion so every spelling of negative zero keeps
  the IEEE-754 sign bit, per RFC 8259 number semantics.

Both fixes are backend-independent (wasm-gc, js, native) and covered by
deterministic regression tests in lex_string_test.mbt and
lex_number_test.mbt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bobzhang

json/lex_number.mbt

@@ -399,12 +399,16 @@ fn ParseContext::lex_number_end(
     // returned Double lossless. `reinterpret_as_uint64` / `reinterpret_as_int64`
     // are value-preserving here because both operands sit in [0, 2^53), well
     // inside the overlap of Int64+ and UInt64.
+    //
+    // The sign is applied after the Int64 -> Double conversion so that `-0`
+    // parses to the IEEE-754 negative zero (`-(0L)` is still `0L`, but
+    // `-(0.0)` is `-0.0`), matching the `-0.0` / `-0e0` paths below.
     if !scan.many_digits &&
       scan.exponent == 0L &&
       scan.mantissa <= SAFE_INTEGER_LIMIT.reinterpret_as_uint64() {
-      let v = scan.mantissa.reinterpret_as_int64()
-      let signed = if scan.negative { -v } else { v }
-      return { value: signed.to_double(), repr: None }
+      let v = scan.mantissa.reinterpret_as_int64().to_double()
+      let value = if scan.negative { -v } else { v }
+      return { value, repr: None }
     }
     return ctx.lex_integer_end(start, end)
   }

json/lex_number_test.mbt

@@ -170,3 +170,27 @@ test "parse number with huge exponent" {
     ),
   )
 }
+
+///|
+/// Every spelling of a negative zero — including values that underflow to
+/// zero — must keep the IEEE-754 sign bit. The integer spelling `-0` used to
+/// lose it: the integer fast path negated an `Int64` (where `-0 == 0`)
+/// before converting to `Double`.
+test "parse preserves the sign of negative zero" {
+  fn is_negative(text : String) -> Bool raise {
+    guard @json.parse(text) is Number(n, ..) else { fail("not a number") }
+    n.reinterpret_as_int64() < 0L
+  }
+
+  // Zero literals.
+  assert_true(is_negative("-0"))
+  assert_true(is_negative("-0.0"))
+  assert_true(is_negative("-0e0"))
+  assert_true(is_negative("-0.00E-7"))
+  assert_false(is_negative("0"))
+  assert_false(is_negative("0.0"))
+  // Negative values that underflow to zero.
+  assert_true(is_negative("-1e-400"))
+  assert_true(is_negative("-4.9e-325"))
+  assert_true(is_negative("-1e-999999999999999999999999999999999999"))
+}

json/lex_string.mbt

@@ -39,8 +39,12 @@ fn ParseContext::lex_string_slow(ctx : ParseContext) -> String raise ParseError
   let buf = StringBuilder()
   let mut start = ctx.offset
   fn flush(end : Int) {
-    if start > 0 && end > start {
-      buf.write_view(ctx.input[start:end])
+    if end > start {
+      // `view(start_offset~, end_offset~)` only bounds-checks; the checked
+      // `ctx.input[start:end]` aborts when the code unit at a boundary is a
+      // trailing surrogate, which a raw lone surrogate inside the string
+      // (accepted by the fast path in `lex_string`) can trigger here.
+      buf.write_view(ctx.input.view(start_offset=start, end_offset=end))
     }
   }
 

json/lex_string_test.mbt

@@ -89,3 +89,28 @@ test "lex_hex_digits accepts all hex digit ranges" {
     ),
   )
 }
+
+///|
+/// Regression for #4049: a raw lone surrogate combined with an escape used to
+/// abort the process instead of parsing. The slow-path lexer's `flush` sliced
+/// the pending run with the checked `ctx.input[start:end]`, which panics when
+/// the code unit at a slice boundary is a trailing surrogate; the escape-free
+/// fast path already accepted the same strings.
+test "lone surrogates with escapes parse instead of aborting" {
+  let lone_low = String::from_array([(0xDC00).unsafe_to_char()])
+  let lone_high = String::from_array([(0xD800).unsafe_to_char()])
+  // Lone trailing surrogate before / after an escape.
+  assert_true(
+    @json.parse("\"" + lone_low + "\\n\"") == Json::string(lone_low + "\n"),
+  )
+  assert_true(
+    @json.parse("\"\\n" + lone_low + "\"") == Json::string("\n" + lone_low),
+  )
+  // Lone leading surrogate with an escape.
+  assert_true(
+    @json.parse("\"" + lone_high + "\\t\"") == Json::string(lone_high + "\t"),
+  )
+  // Surrogates on both sides of an escaped backslash, via stringify/parse.
+  let json = Json::string(lone_low + "\\" + lone_high)
+  assert_true(@json.parse(json.stringify()) == json)
+}