Bug 412068 - Number.prototype.toLocaleString incorrectly accesses the memory where its first argument should be, even if no first argument is actually given. Tag-team r=igor, r+a=brendan By the way, this checkin occurred on an orange tree. Just like every other patch in the last day. Yay checkin policy.

js/src/jsnum.c

@@ -255,7 +255,7 @@ num_toString(JSContext *cx, uintN argc, jsval *vp)
     JS_ASSERT(JSVAL_IS_NUMBER(v));
     d = JSVAL_IS_INT(v) ? (jsdouble)JSVAL_TO_INT(v) : *JSVAL_TO_DOUBLE(v);
     base = 10;
-    if (!JSVAL_IS_VOID(vp[2])) {
+    if (argc != 0 && !JSVAL_IS_VOID(vp[2])) {
         if (!js_ValueToECMAInt32(cx, vp[2], &base))
             return JS_FALSE;
         if (base < 2 || base > 36) {
@@ -299,7 +299,7 @@ num_toLocaleString(JSContext *cx, uintN argc, jsval *vp)
      * Create the string, move back to bytes to make string twiddling
      * a bit easier and so we can insert platform charset seperators.
      */
-    if (!num_toString(cx, argc, vp))
+    if (!num_toString(cx, 0, vp))
         return JS_FALSE;
     JS_ASSERT(JSVAL_IS_STRING(*vp));
     numStr = JSVAL_TO_STRING(*vp);
@@ -479,7 +479,7 @@ static JSFunctionSpec number_methods[] = {
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str,       num_toSource,       0,0,JSFUN_THISP_NUMBER),
 #endif
-    JS_FN(js_toString_str,       num_toString,       1,1,JSFUN_THISP_NUMBER),
+    JS_FN(js_toString_str,       num_toString,       0,1,JSFUN_THISP_NUMBER),
     JS_FN(js_toLocaleString_str, num_toLocaleString, 0,0,JSFUN_THISP_NUMBER),
     JS_FN(js_valueOf_str,        num_valueOf,        0,0,JSFUN_THISP_NUMBER),
     JS_FN("toFixed",             num_toFixed,        1,1,JSFUN_THISP_NUMBER),

js/tests/ecma_3/Number/15.7.4.3-01.js

@@ -0,0 +1,69 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is JavaScript Engine testing utilities.
+ *
+ * The Initial Developer of the Original Code is
+ * Jeff Walden.
+ * Portions created by the Initial Developer are Copyright (C) 2008
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+var gTestfile = '15.7.4.3-01.js';
+//-----------------------------------------------------------------------------
+var BUGNUMBER = "412068";
+var summary = "num.toLocaleString incorrectly accesses its first argument " +
+              "even when no first argument has been given";
+var actual, expect;
+
+printBugNumber(BUGNUMBER);
+printStatus(summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var failed = false;
+
+try
+{
+  if ("3" !== 3..toLocaleString())
+    throw '"3" should equal 3..toLocaleString()";
+  if ("9" !== 9..toLocaleString(8))
+    throw 'Number.prototype.toLocaleString should ignore its first argument';
+}
+catch (e)
+{
+  failed = e;
+}
+
+expect = false;
+actual = failed;
+
+reportCompare(expect, actual, summary);