Fix Number.prototype.toFixed if argument is outside int32 range

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai.u-szeged@partner.samsung.com

Author: dbatyai

jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp

@@ -200,11 +200,8 @@ ecma_builtin_number_prototype_object_to_fixed (ecma_value_t this_arg, /**< this
   ECMA_OP_TO_NUMBER_TRY_CATCH (this_num, this_arg, ret_value);
   ECMA_OP_TO_NUMBER_TRY_CATCH (arg_num, arg, ret_value);
 
-  /* 1. */
-  int32_t frac_digits = ecma_number_to_int32 (arg_num);
-
   /* 2. */
-  if (frac_digits < 0 || frac_digits > 20)
+  if (arg_num <= -1 || arg_num >= 21)
   {
     ret_value = ecma_make_throw_obj_completion_value (ecma_new_standard_error (ECMA_ERROR_RANGE));
   }
@@ -251,6 +248,9 @@ ecma_builtin_number_prototype_object_to_fixed (ecma_value_t this_arg, /**< this
         int32_t num_digits = 0;
         int32_t exponent = 1;
 
+        /* 1. */
+        int32_t frac_digits = ecma_number_to_int32 (arg_num);
+
         /* Get the parameters of the number if non-zero. */
         if (!ecma_number_is_zero (this_num))
         {

tests/jerry/number_prototype_to_fixed.js

@@ -35,10 +35,26 @@ assert((0.0).toFixed(1) === "0.0");
 assert((-0.0).toFixed(0) === "-0");
 assert((-0.0).toFixed(1) === "-0.0");
 assert((123456789012345678901.0).toFixed(20) === "123456789012345680000.00000000000000000000");
+assert((123.56).toFixed(NaN) === "124");
+assert((123.56).toFixed(-0.9) === "124");
 
 var obj = { toFixed : Number.prototype.toFixed };
 assert(obj.toFixed(0) === "NaN");
 
+try {
+    assert(obj.toFixed(Infinity));
+    assert(false);
+} catch (e) {
+    assert(e instanceof RangeError);
+}
+
+try {
+    assert(obj.toFixed(-Infinity));
+    assert(false);
+} catch (e) {
+    assert(e instanceof RangeError);
+}
+
 try {
     assert(obj.toFixed(-1));
     assert(false);