From 47cd42ecc5a7f4205736663916ff1acfd4f0efbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1niel=20B=C3=A1tyai?=
 <dbatyai.u-szeged@partner.samsung.com>
Date: Mon, 6 Jul 2015 15:17:27 +0200
Subject: [PATCH] Fix Number.prototype.toFixed if argument is outside int32
 range
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai.u-szeged@partner.samsung.com
---
 .../ecma-builtin-number-prototype.cpp            |  8 ++++----
 tests/jerry/number_prototype_to_fixed.js         | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp b/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp
index 83c7a73cab..bf881f06d1 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp
@@ -200,11 +200,8 @@ ecma_builtin_number_prototype_object_to_fixed (ecma_value_t this_arg, /**< this
   ECMA_OP_TO_NUMBER_TRY_CATCH (this_num, this_arg, ret_value);
   ECMA_OP_TO_NUMBER_TRY_CATCH (arg_num, arg, ret_value);
 
-  /* 1. */
-  int32_t frac_digits = ecma_number_to_int32 (arg_num);
-
   /* 2. */
-  if (frac_digits < 0 || frac_digits > 20)
+  if (arg_num <= -1 || arg_num >= 21)
   {
     ret_value = ecma_make_throw_obj_completion_value (ecma_new_standard_error (ECMA_ERROR_RANGE));
   }
@@ -251,6 +248,9 @@ ecma_builtin_number_prototype_object_to_fixed (ecma_value_t this_arg, /**< this
         int32_t num_digits = 0;
         int32_t exponent = 1;
 
+        /* 1. */
+        int32_t frac_digits = ecma_number_to_int32 (arg_num);
+
         /* Get the parameters of the number if non-zero. */
         if (!ecma_number_is_zero (this_num))
         {
diff --git a/tests/jerry/number_prototype_to_fixed.js b/tests/jerry/number_prototype_to_fixed.js
index 82e0bf07cb..0dbb6ce566 100644
--- a/tests/jerry/number_prototype_to_fixed.js
+++ b/tests/jerry/number_prototype_to_fixed.js
@@ -35,10 +35,26 @@ assert((0.0).toFixed(1) === "0.0");
 assert((-0.0).toFixed(0) === "-0");
 assert((-0.0).toFixed(1) === "-0.0");
 assert((123456789012345678901.0).toFixed(20) === "123456789012345680000.00000000000000000000");
+assert((123.56).toFixed(NaN) === "124");
+assert((123.56).toFixed(-0.9) === "124");
 
 var obj = { toFixed : Number.prototype.toFixed };
 assert(obj.toFixed(0) === "NaN");
 
+try {
+    assert(obj.toFixed(Infinity));
+    assert(false);
+} catch (e) {
+    assert(e instanceof RangeError);
+}
+
+try {
+    assert(obj.toFixed(-Infinity));
+    assert(false);
+} catch (e) {
+    assert(e instanceof RangeError);
+}
+
 try {
     assert(obj.toFixed(-1));
     assert(false);