<rdar://problem/5759327> REGRESSION: while(NaN) acts like while(true)

Reviewed by Alexey P.

Fix yet another case where we incorrectly relied on implicit double
to bool coercion.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@30475 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index e1eb843..2ba76d5 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,15 @@
+2008-02-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey P.
+
+        <rdar://problem/5759327> REGRESSION: while(NaN) acts like while(true)
+
+        Fix yet another case where we incorrectly relied on implicit double
+        to bool coercion.
+
+        * kjs/nodes.cpp:
+        (KJS::PostDecLocalVarNode::evaluateToBoolean):
+
 2008-02-20  Michael Knaup  <michael.knaup@mac.com>
 
         Reviewed by Darin.

diff --git a/JavaScriptCore/kjs/nodes.cpp b/JavaScriptCore/kjs/nodes.cpp
index a2eaf36..ba607b3 100644 (file)
--- a/JavaScriptCore/kjs/nodes.cpp
+++ b/JavaScriptCore/kjs/nodes.cpp
@@ -1399,7 +1399,8 @@ double PostDecLocalVarNode::evaluateToNumber(ExecState* exec)
 
 bool PostDecLocalVarNode::evaluateToBoolean(ExecState* exec)
 {
-    return inlineEvaluateToNumber(exec);
+    double result = inlineEvaluateToNumber(exec);
+    return  result > 0.0 || 0.0 > result; // NaN produces false as well
 }
 
 int32_t PostDecLocalVarNode::evaluateToInt32(ExecState* exec)

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 4a88d74..0548d75 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2008-02-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey P.
+
+        <rdar://problem/5759327> REGRESSION: while(NaN) acts like while(true)
+
+        Add test cases for pre/post-increment of NaN
+
+        * fast/js/convert-nan-to-bool-expected.txt:
+        * fast/js/resources/convert-nan-to-bool.js:
+
 2008-02-21  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.

diff --git a/LayoutTests/fast/js/convert-nan-to-bool-expected.txt b/LayoutTests/fast/js/convert-nan-to-bool-expected.txt
index 3d5d836..60a99bb 100644 (file)
--- a/LayoutTests/fast/js/convert-nan-to-bool-expected.txt
+++ b/LayoutTests/fast/js/convert-nan-to-bool-expected.txt
@@ -60,6 +60,14 @@ PASS NaN && true ? true : false is false
 PASS NaN && false ? true : false is false
 PASS NaN || true ? true : false is true
 PASS NaN || false ? true : false is false
+PASS (function(){var nan = NaN; return nan-- ? true : false})() is false
+PASS (function(){var nan = NaN; return nan++ ? true : false})() is false
+PASS (function(){var nan = NaN; return --nan ? true : false})() is false
+PASS (function(){var nan = NaN; return ++nan ? true : false})() is false
+PASS (function(){var Undefined = undefined; return Undefined-- ? true : false})() is false
+PASS (function(){var Undefined = undefined; return Undefined++ ? true : false})() is false
+PASS (function(){var Undefined = undefined; return --Undefined ? true : false})() is false
+PASS (function(){var Undefined = undefined; return ++Undefined ? true : false})() is false
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/LayoutTests/fast/js/resources/convert-nan-to-bool.js b/LayoutTests/fast/js/resources/convert-nan-to-bool.js
index 273bb42..6fe4cb4 100644 (file)
--- a/LayoutTests/fast/js/resources/convert-nan-to-bool.js
+++ b/LayoutTests/fast/js/resources/convert-nan-to-bool.js
@@ -57,5 +57,13 @@ shouldBe("NaN && true ? true : false", "false");
 shouldBe("NaN && false ? true : false", "false");
 shouldBe("NaN || true ? true : false", "true");
 shouldBe("NaN || false ? true : false", "false");
+shouldBe("(function(){var nan = NaN; return nan-- ? true : false})()", "false");
+shouldBe("(function(){var nan = NaN; return nan++ ? true : false})()", "false");
+shouldBe("(function(){var nan = NaN; return --nan ? true : false})()", "false");
+shouldBe("(function(){var nan = NaN; return ++nan ? true : false})()", "false");
+shouldBe("(function(){var Undefined = undefined; return Undefined-- ? true : false})()", "false");
+shouldBe("(function(){var Undefined = undefined; return Undefined++ ? true : false})()", "false");
+shouldBe("(function(){var Undefined = undefined; return --Undefined ? true : false})()", "false");
+shouldBe("(function(){var Undefined = undefined; return ++Undefined ? true : false})()", "false");
 
 var successfullyParsed = true;