The Tor Browser: js/src/jsnum.cpp@6474c204b198 (annotated)

js/src/jsnum.cpp@6474c204b198 (annotated)

js/src/jsnum.cpp

Wed, 31 Dec 2014 06:09:35 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Wed, 31 Dec 2014 06:09:35 +0100
changeset 0: 6474c204b198
permissions: -rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * JS number type and wrapper class.
  */
 #include "jsnum.h"
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/PodOperations.h"
 #include "mozilla/RangedPtr.h"
 #ifdef HAVE_LOCALECONV
 #include <locale.h>
 #endif
 #include <math.h>
 #include <string.h>
 #include "double-conversion.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsdtoa.h"
 #include "jsobj.h"
 #include "jsstr.h"
 #include "jstypes.h"
 #include "vm/GlobalObject.h"
 #include "vm/NumericConversions.h"
 #include "vm/StringBuffer.h"
 #include "jsatominlines.h"
 #include "vm/NumberObject-inl.h"
 #include "vm/String-inl.h"
 using namespace js;
 using namespace js::types;
 using mozilla::Abs;
 using mozilla::MinNumberValue;
 using mozilla::NegativeInfinity;
 using mozilla::PodCopy;
 using mozilla::PositiveInfinity;
 using mozilla::RangedPtr;
 using JS::GenericNaN;
 /*
  * If we're accumulating a decimal number and the number is >= 2^53, then the
  * fast result from the loop in Get{Prefix,Decimal}Integer may be inaccurate.
  * Call js_strtod_harder to get the correct answer.
  */
 static bool
 ComputeAccurateDecimalInteger(ThreadSafeContext *cx,
                               const jschar *start, const jschar *end, double *dp)
 {
     size_t length = end - start;
     char *cstr = cx->pod_malloc<char>(length + 1);
     if (!cstr)
         return false;
     for (size_t i = 0; i < length; i++) {
         char c = char(start[i]);
         JS_ASSERT(('0' <= c && c <= '9') || ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z'));
         cstr[i] = c;
     }
     cstr[length] = 0;
     char *estr;
     int err = 0;
     *dp = js_strtod_harder(cx->dtoaState(), cstr, &estr, &err);
     if (err == JS_DTOA_ENOMEM) {
         js_ReportOutOfMemory(cx);
         js_free(cstr);
         return false;
     }
     js_free(cstr);
     return true;
 }
 namespace {
 class BinaryDigitReader
 {
     const int base;      /* Base of number; must be a power of 2 */
     int digit;           /* Current digit value in radix given by base */
     int digitMask;       /* Mask to extract the next bit from digit */
     const jschar *start; /* Pointer to the remaining digits */
     const jschar *end;   /* Pointer to first non-digit */
   public:
     BinaryDigitReader(int base, const jschar *start, const jschar *end)
       : base(base), digit(0), digitMask(0), start(start), end(end)
     {
     }
     /* Return the next binary digit from the number, or -1 if done. */
     int nextDigit() {
         if (digitMask == 0) {
             if (start == end)
                 return -1;
             int c = *start++;
             JS_ASSERT(('0' <= c && c <= '9') || ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z'));
             if ('0' <= c && c <= '9')
                 digit = c - '0';
             else if ('a' <= c && c <= 'z')
                 digit = c - 'a' + 10;
             else
                 digit = c - 'A' + 10;
             digitMask = base >> 1;
         }
         int bit = (digit & digitMask) != 0;
         digitMask >>= 1;
         return bit;
     }
 };
 } /* anonymous namespace */
 /*
  * The fast result might also have been inaccurate for power-of-two bases. This
  * happens if the addition in value * 2 + digit causes a round-down to an even
  * least significant mantissa bit when the first dropped bit is a one.  If any
  * of the following digits in the number (which haven't been added in yet) are
  * nonzero, then the correct action would have been to round up instead of
  * down.  An example occurs when reading the number 0x1000000000000081, which
  * rounds to 0x1000000000000000 instead of 0x1000000000000100.
  */
 static double
 ComputeAccurateBinaryBaseInteger(const jschar *start, const jschar *end, int base)
 {
     BinaryDigitReader bdr(base, start, end);
     /* Skip leading zeroes. */
     int bit;
     do {
         bit = bdr.nextDigit();
     } while (bit == 0);
     JS_ASSERT(bit == 1); // guaranteed by Get{Prefix,Decimal}Integer
     /* Gather the 53 significant bits (including the leading 1). */
     double value = 1.0;
     for (int j = 52; j > 0; j--) {
         bit = bdr.nextDigit();
         if (bit < 0)
             return value;
         value = value * 2 + bit;
     }
     /* bit2 is the 54th bit (the first dropped from the mantissa). */
     int bit2 = bdr.nextDigit();
     if (bit2 >= 0) {
         double factor = 2.0;
         int sticky = 0;  /* sticky is 1 if any bit beyond the 54th is 1 */
         int bit3;
         while ((bit3 = bdr.nextDigit()) >= 0) {
             sticky |= bit3;
             factor *= 2;
         }
         value += bit2 & (bit | sticky);
         value *= factor;
     }
     return value;
 }
 double
 js::ParseDecimalNumber(const JS::TwoByteChars chars)
 {
     MOZ_ASSERT(chars.length() > 0);
     uint64_t dec = 0;
     RangedPtr<jschar> s = chars.start(), end = chars.end();
     do {
         jschar c = *s;
         MOZ_ASSERT('0' <= c && c <= '9');
         uint8_t digit = c - '0';
         uint64_t next = dec * 10 + digit;
         MOZ_ASSERT(next < DOUBLE_INTEGRAL_PRECISION_LIMIT,
                    "next value won't be an integrally-precise double");
         dec = next;
     } while (++s < end);
     return static_cast<double>(dec);
 }
 bool
 js::GetPrefixInteger(ThreadSafeContext *cx, const jschar *start, const jschar *end, int base,
                      const jschar **endp, double *dp)
 {
     JS_ASSERT(start <= end);
     JS_ASSERT(2 <= base && base <= 36);
     const jschar *s = start;
     double d = 0.0;
     for (; s < end; s++) {
         int digit;
         jschar c = *s;
         if ('0' <= c && c <= '9')
             digit = c - '0';
         else if ('a' <= c && c <= 'z')
             digit = c - 'a' + 10;
         else if ('A' <= c && c <= 'Z')
             digit = c - 'A' + 10;
         else
             break;
         if (digit >= base)
             break;
         d = d * base + digit;
     }
     *endp = s;
     *dp = d;
     /* If we haven't reached the limit of integer precision, we're done. */
     if (d < DOUBLE_INTEGRAL_PRECISION_LIMIT)
         return true;
     /*
      * Otherwise compute the correct integer from the prefix of valid digits
      * if we're computing for base ten or a power of two.  Don't worry about
      * other bases; see 15.1.2.2 step 13.
      */
     if (base == 10)
         return ComputeAccurateDecimalInteger(cx, start, s, dp);
     if ((base & (base - 1)) == 0)
         *dp = ComputeAccurateBinaryBaseInteger(start, s, base);
     return true;
 }
 bool
 js::GetDecimalInteger(ExclusiveContext *cx, const jschar *start, const jschar *end, double *dp)
 {
     JS_ASSERT(start <= end);
     const jschar *s = start;
     double d = 0.0;
     for (; s < end; s++) {
         jschar c = *s;
         JS_ASSERT('0' <= c && c <= '9');
         int digit = c - '0';
         d = d * 10 + digit;
     }
     *dp = d;
     // If we haven't reached the limit of integer precision, we're done.
     if (d < DOUBLE_INTEGRAL_PRECISION_LIMIT)
         return true;
     // Otherwise compute the correct integer from the prefix of valid digits.
     return ComputeAccurateDecimalInteger(cx, start, s, dp);
 }
 static bool
 num_isNaN(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() == 0) {
         args.rval().setBoolean(true);
         return true;
     }
     double x;
     if (!ToNumber(cx, args[0], &x))
         return false;
     args.rval().setBoolean(mozilla::IsNaN(x));
     return true;
 }
 static bool
 num_isFinite(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() == 0) {
         args.rval().setBoolean(false);
         return true;
     }
     double x;
     if (!ToNumber(cx, args[0], &x))
         return false;
     args.rval().setBoolean(mozilla::IsFinite(x));
     return true;
 }
 static bool
 num_parseFloat(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() == 0) {
         args.rval().setNaN();
         return true;
     }
     JSString *str = ToString<CanGC>(cx, args[0]);
     if (!str)
         return false;
     const jschar *bp = str->getChars(cx);
     if (!bp)
         return false;
     const jschar *end = bp + str->length();
     const jschar *ep;
     double d;
     if (!js_strtod(cx, bp, end, &ep, &d))
         return false;
     if (ep == bp) {
         args.rval().setNaN();
         return true;
     }
     args.rval().setDouble(d);
     return true;
 }
 /* ES5 15.1.2.2. */
 bool
 js::num_parseInt(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     /* Fast paths and exceptional cases. */
     if (args.length() == 0) {
         args.rval().setNaN();
         return true;
     }
     if (args.length() == 1 ||
         (args[1].isInt32() && (args[1].toInt32() == 0 || args[1].toInt32() == 10))) {
         if (args[0].isInt32()) {
             args.rval().set(args[0]);
             return true;
         }
         /*
          * Step 1 is |inputString = ToString(string)|. When string >=
          * 1e21, ToString(string) is in the form "NeM". 'e' marks the end of
          * the word, which would mean the result of parseInt(string) should be |N|.
          *
          * To preserve this behaviour, we can't use the fast-path when string >
          * 1e21, or else the result would be |NeM|.
          *
          * The same goes for values smaller than 1.0e-6, because the string would be in
          * the form of "Ne-M".
          */
         if (args[0].isDouble()) {
             double d = args[0].toDouble();
             if (1.0e-6 < d && d < 1.0e21) {
                 args.rval().setNumber(floor(d));
                 return true;
             }
             if (-1.0e21 < d && d < -1.0e-6) {
                 args.rval().setNumber(-floor(-d));
                 return true;
             }
             if (d == 0.0) {
                 args.rval().setInt32(0);
                 return true;
             }
         }
     }
     /* Step 1. */
     RootedString inputString(cx, ToString<CanGC>(cx, args[0]));
     if (!inputString)
         return false;
     args[0].setString(inputString);
     /* Steps 6-9. */
     bool stripPrefix = true;
     int32_t radix;
     if (!args.hasDefined(1)) {
         radix = 10;
     } else {
         if (!ToInt32(cx, args[1], &radix))
             return false;
         if (radix == 0) {
             radix = 10;
         } else {
             if (radix < 2 || radix > 36) {
                 args.rval().setNaN();
                 return true;
             }
             if (radix != 16)
                 stripPrefix = false;
         }
     }
     /* Step 2. */
     const jschar *s;
     const jschar *end;
     {
         const jschar *ws = inputString->getChars(cx);
         if (!ws)
             return false;
         end = ws + inputString->length();
         s = SkipSpace(ws, end);
         MOZ_ASSERT(ws <= s);
         MOZ_ASSERT(s <= end);
     }
     /* Steps 3-4. */
     bool negative = (s != end && s[0] == '-');
     /* Step 5. */
     if (s != end && (s[0] == '-' || s[0] == '+'))
         s++;
     /* Step 10. */
     if (stripPrefix) {
         if (end - s >= 2 && s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) {
             s += 2;
             radix = 16;
         }
     }
     /* Steps 11-15. */
     const jschar *actualEnd;
     double number;
     if (!GetPrefixInteger(cx, s, end, radix, &actualEnd, &number))
         return false;
     if (s == actualEnd)
         args.rval().setNaN();
     else
         args.rval().setNumber(negative ? -number : number);
     return true;
 }
 static const JSFunctionSpec number_functions[] = {
     JS_FN(js_isNaN_str,         num_isNaN,           1,0),
     JS_FN(js_isFinite_str,      num_isFinite,        1,0),
     JS_FN(js_parseFloat_str,    num_parseFloat,      1,0),
     JS_FN(js_parseInt_str,      num_parseInt,        2,0),
     JS_FS_END
 };
 const Class NumberObject::class_ = {
     js_Number_str,
     JSCLASS_HAS_RESERVED_SLOTS(1) | JSCLASS_HAS_CACHED_PROTO(JSProto_Number),
     JS_PropertyStub,         /* addProperty */
     JS_DeletePropertyStub,   /* delProperty */
     JS_PropertyStub,         /* getProperty */
     JS_StrictPropertyStub,   /* setProperty */
     JS_EnumerateStub,
     JS_ResolveStub,
     JS_ConvertStub
 };
 static bool
 Number(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     /* Sample JS_CALLEE before clobbering. */
     bool isConstructing = args.isConstructing();
     if (args.length() > 0) {
         if (!ToNumber(cx, args[0]))
             return false;
         args.rval().set(args[0]);
     } else {
         args.rval().setInt32(0);
     }
     if (!isConstructing)
         return true;
     JSObject *obj = NumberObject::create(cx, args.rval().toNumber());
     if (!obj)
         return false;
     args.rval().setObject(*obj);
     return true;
 }
 MOZ_ALWAYS_INLINE bool
 IsNumber(HandleValue v)
 {
     return v.isNumber() || (v.isObject() && v.toObject().is<NumberObject>());
 }
 static inline double
 Extract(const Value &v)
 {
     if (v.isNumber())
         return v.toNumber();
     return v.toObject().as<NumberObject>().unbox();
 }
 #if JS_HAS_TOSOURCE
 MOZ_ALWAYS_INLINE bool
 num_toSource_impl(JSContext *cx, CallArgs args)
 {
     double d = Extract(args.thisv());
     StringBuffer sb(cx);
     if (!sb.append("(new Number(") ||
         !NumberValueToStringBuffer(cx, NumberValue(d), sb) ||
         !sb.append("))"))
     {
         return false;
     }
     JSString *str = sb.finishString();
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 static bool
 num_toSource(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_toSource_impl>(cx, args);
 }
 #endif
 ToCStringBuf::ToCStringBuf() :dbuf(nullptr)
 {
     JS_STATIC_ASSERT(sbufSize >= DTOSTR_STANDARD_BUFFER_SIZE);
 }
 ToCStringBuf::~ToCStringBuf()
 {
     js_free(dbuf);
 }
 MOZ_ALWAYS_INLINE
 static JSFlatString *
 LookupDtoaCache(ThreadSafeContext *cx, double d)
 {
     if (!cx->isExclusiveContext())
         return nullptr;
     if (JSCompartment *comp = cx->asExclusiveContext()->compartment()) {
         if (JSFlatString *str = comp->dtoaCache.lookup(10, d))
             return str;
     }
     return nullptr;
 }
 MOZ_ALWAYS_INLINE
 static void
 CacheNumber(ThreadSafeContext *cx, double d, JSFlatString *str)
 {
     if (!cx->isExclusiveContext())
         return;
     if (JSCompartment *comp = cx->asExclusiveContext()->compartment())
         comp->dtoaCache.cache(10, d, str);
 }
 MOZ_ALWAYS_INLINE
 static JSFlatString *
 LookupInt32ToString(ThreadSafeContext *cx, int32_t si)
 {
     if (si >= 0 && StaticStrings::hasInt(si))
         return cx->staticStrings().getInt(si);
     return LookupDtoaCache(cx, si);
 }
 template <typename T>
 MOZ_ALWAYS_INLINE
 static T *
 BackfillInt32InBuffer(int32_t si, T *buffer, size_t size, size_t *length)
 {
     uint32_t ui = Abs(si);
     JS_ASSERT_IF(si == INT32_MIN, ui == uint32_t(INT32_MAX) + 1);
     RangedPtr<T> end(buffer + size - 1, buffer, size);
     *end = '\0';
     RangedPtr<T> start = BackfillIndexInCharBuffer(ui, end);
     if (si < 0)
         *--start = '-';
     *length = end - start;
     return start.get();
 }
 template <AllowGC allowGC>
 JSFlatString *
 js::Int32ToString(ThreadSafeContext *cx, int32_t si)
 {
     if (JSFlatString *str = LookupInt32ToString(cx, si))
         return str;
     JSFatInlineString *str = js_NewGCFatInlineString<allowGC>(cx);
     if (!str)
         return nullptr;
     jschar buffer[JSFatInlineString::MAX_FAT_INLINE_LENGTH + 1];
     size_t length;
     jschar *start = BackfillInt32InBuffer(si, buffer,
                                           JSFatInlineString::MAX_FAT_INLINE_LENGTH + 1, &length);
     PodCopy(str->init(length), start, length + 1);
     CacheNumber(cx, si, str);
     return str;
 }
 template JSFlatString *
 js::Int32ToString<CanGC>(ThreadSafeContext *cx, int32_t si);
 template JSFlatString *
 js::Int32ToString<NoGC>(ThreadSafeContext *cx, int32_t si);
 JSAtom *
 js::Int32ToAtom(ExclusiveContext *cx, int32_t si)
 {
     if (JSFlatString *str = LookupInt32ToString(cx, si))
         return js::AtomizeString(cx, str);
     char buffer[JSFatInlineString::MAX_FAT_INLINE_LENGTH + 1];
     size_t length;
     char *start = BackfillInt32InBuffer(si, buffer, JSFatInlineString::MAX_FAT_INLINE_LENGTH + 1, &length);
     JSAtom *atom = Atomize(cx, start, length);
     if (!atom)
         return nullptr;
     CacheNumber(cx, si, atom);
     return atom;
 }
 /* Returns a non-nullptr pointer to inside cbuf.  */
 static char *
 Int32ToCString(ToCStringBuf *cbuf, int32_t i, size_t *len, int base = 10)
 {
     uint32_t u = Abs(i);
     RangedPtr<char> cp(cbuf->sbuf + ToCStringBuf::sbufSize - 1, cbuf->sbuf, ToCStringBuf::sbufSize);
     char *end = cp.get();
     *cp = '\0';
     /* Build the string from behind. */
     switch (base) {
     case 10:
       cp = BackfillIndexInCharBuffer(u, cp);
       break;
     case 16:
       do {
           unsigned newu = u / 16;
           *--cp = "0123456789abcdef"[u - newu * 16];
           u = newu;
       } while (u != 0);
       break;
     default:
       JS_ASSERT(base >= 2 && base <= 36);
       do {
           unsigned newu = u / base;
           *--cp = "0123456789abcdefghijklmnopqrstuvwxyz"[u - newu * base];
           u = newu;
       } while (u != 0);
       break;
     }
     if (i < 0)
         *--cp = '-';
     *len = end - cp.get();
     return cp.get();
 }
 template <AllowGC allowGC>
 static JSString * JS_FASTCALL
 js_NumberToStringWithBase(ThreadSafeContext *cx, double d, int base);
 MOZ_ALWAYS_INLINE bool
 num_toString_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsNumber(args.thisv()));
     double d = Extract(args.thisv());
     int32_t base = 10;
     if (args.hasDefined(0)) {
         double d2;
         if (!ToInteger(cx, args[0], &d2))
             return false;
         if (d2 < 2 || d2 > 36) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_RADIX);
             return false;
         }
         base = int32_t(d2);
     }
     JSString *str = js_NumberToStringWithBase<CanGC>(cx, d, base);
     if (!str) {
         JS_ReportOutOfMemory(cx);
         return false;
     }
     args.rval().setString(str);
     return true;
 }
 bool
 js_num_toString(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_toString_impl>(cx, args);
 }
 #if !EXPOSE_INTL_API
 MOZ_ALWAYS_INLINE bool
 num_toLocaleString_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsNumber(args.thisv()));
     double d = Extract(args.thisv());
     Rooted<JSString*> str(cx, js_NumberToStringWithBase<CanGC>(cx, d, 10));
     if (!str) {
         JS_ReportOutOfMemory(cx);
         return false;
     }
     /*
      * Create the string, move back to bytes to make string twiddling
      * a bit easier and so we can insert platform charset seperators.
      */
     JSAutoByteString numBytes(cx, str);
     if (!numBytes)
         return false;
     const char *num = numBytes.ptr();
     if (!num)
         return false;
     /*
      * Find the first non-integer value, whether it be a letter as in
      * 'Infinity', a decimal point, or an 'e' from exponential notation.
      */
     const char *nint = num;
     if (*nint == '-')
         nint++;
     while (*nint >= '0' && *nint <= '9')
         nint++;
     int digits = nint - num;
     const char *end = num + digits;
     if (!digits) {
         args.rval().setString(str);
         return true;
     }
     JSRuntime *rt = cx->runtime();
     size_t thousandsLength = strlen(rt->thousandsSeparator);
     size_t decimalLength = strlen(rt->decimalSeparator);
     /* Figure out how long resulting string will be. */
     int buflen = strlen(num);
     if (*nint == '.')
         buflen += decimalLength - 1; /* -1 to account for existing '.' */
     const char *numGrouping;
     const char *tmpGroup;
     numGrouping = tmpGroup = rt->numGrouping;
     int remainder = digits;
     if (*num == '-')
         remainder--;
     while (*tmpGroup != CHAR_MAX && *tmpGroup != '\0') {
         if (*tmpGroup >= remainder)
             break;
         buflen += thousandsLength;
         remainder -= *tmpGroup;
         tmpGroup++;
     }
     int nrepeat;
     if (*tmpGroup == '\0' && *numGrouping != '\0') {
         nrepeat = (remainder - 1) / tmpGroup[-1];
         buflen += thousandsLength * nrepeat;
         remainder -= nrepeat * tmpGroup[-1];
     } else {
         nrepeat = 0;
     }
     tmpGroup--;
     char *buf = cx->pod_malloc<char>(buflen + 1);
     if (!buf)
         return false;
     char *tmpDest = buf;
     const char *tmpSrc = num;
     while (*tmpSrc == '-' || remainder--) {
         JS_ASSERT(tmpDest - buf < buflen);
         *tmpDest++ = *tmpSrc++;
     }
     while (tmpSrc < end) {
         JS_ASSERT(tmpDest - buf + ptrdiff_t(thousandsLength) <= buflen);
         strcpy(tmpDest, rt->thousandsSeparator);
         tmpDest += thousandsLength;
         JS_ASSERT(tmpDest - buf + *tmpGroup <= buflen);
         js_memcpy(tmpDest, tmpSrc, *tmpGroup);
         tmpDest += *tmpGroup;
         tmpSrc += *tmpGroup;
         if (--nrepeat < 0)
             tmpGroup--;
     }
     if (*nint == '.') {
         JS_ASSERT(tmpDest - buf + ptrdiff_t(decimalLength) <= buflen);
         strcpy(tmpDest, rt->decimalSeparator);
         tmpDest += decimalLength;
         JS_ASSERT(tmpDest - buf + ptrdiff_t(strlen(nint + 1)) <= buflen);
         strcpy(tmpDest, nint + 1);
     } else {
         JS_ASSERT(tmpDest - buf + ptrdiff_t(strlen(nint)) <= buflen);
         strcpy(tmpDest, nint);
     }
     if (cx->runtime()->localeCallbacks && cx->runtime()->localeCallbacks->localeToUnicode) {
         Rooted<Value> v(cx, StringValue(str));
         bool ok = !!cx->runtime()->localeCallbacks->localeToUnicode(cx, buf, &v);
         if (ok)
             args.rval().set(v);
         js_free(buf);
         return ok;
     }
     str = js_NewStringCopyN<CanGC>(cx, buf, buflen);
     js_free(buf);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 static bool
 num_toLocaleString(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_toLocaleString_impl>(cx, args);
 }
 #endif /* !EXPOSE_INTL_API */
 MOZ_ALWAYS_INLINE bool
 num_valueOf_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsNumber(args.thisv()));
     args.rval().setNumber(Extract(args.thisv()));
     return true;
 }
 bool
 js_num_valueOf(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_valueOf_impl>(cx, args);
 }
 static const unsigned MAX_PRECISION = 100;
 static bool
 ComputePrecisionInRange(JSContext *cx, int minPrecision, int maxPrecision, HandleValue v,
                         int *precision)
 {
     double prec;
     if (!ToInteger(cx, v, &prec))
         return false;
     if (minPrecision <= prec && prec <= maxPrecision) {
         *precision = int(prec);
         return true;
     }
     ToCStringBuf cbuf;
     if (char *numStr = NumberToCString(cx, &cbuf, prec, 10))
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_PRECISION_RANGE, numStr);
     return false;
 }
 static bool
 DToStrResult(JSContext *cx, double d, JSDToStrMode mode, int precision, CallArgs args)
 {
     char buf[DTOSTR_VARIABLE_BUFFER_SIZE(MAX_PRECISION + 1)];
     char *numStr = js_dtostr(cx->mainThread().dtoaState, buf, sizeof buf, mode, precision, d);
     if (!numStr) {
         JS_ReportOutOfMemory(cx);
         return false;
     }
     JSString *str = js_NewStringCopyZ<CanGC>(cx, numStr);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 /*
  * In the following three implementations, we allow a larger range of precision
  * than ECMA requires; this is permitted by ECMA-262.
  */
 MOZ_ALWAYS_INLINE bool
 num_toFixed_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsNumber(args.thisv()));
     int precision;
     if (args.length() == 0) {
         precision = 0;
     } else {
         if (!ComputePrecisionInRange(cx, -20, MAX_PRECISION, args[0], &precision))
             return false;
     }
     return DToStrResult(cx, Extract(args.thisv()), DTOSTR_FIXED, precision, args);
 }
 static bool
 num_toFixed(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_toFixed_impl>(cx, args);
 }
 MOZ_ALWAYS_INLINE bool
 num_toExponential_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsNumber(args.thisv()));
     JSDToStrMode mode;
     int precision;
     if (!args.hasDefined(0)) {
         mode = DTOSTR_STANDARD_EXPONENTIAL;
         precision = 0;
     } else {
         mode = DTOSTR_EXPONENTIAL;
         if (!ComputePrecisionInRange(cx, 0, MAX_PRECISION, args[0], &precision))
             return false;
     }
     return DToStrResult(cx, Extract(args.thisv()), mode, precision + 1, args);
 }
 static bool
 num_toExponential(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_toExponential_impl>(cx, args);
 }
 MOZ_ALWAYS_INLINE bool
 num_toPrecision_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsNumber(args.thisv()));
     double d = Extract(args.thisv());
     if (!args.hasDefined(0)) {
         JSString *str = js_NumberToStringWithBase<CanGC>(cx, d, 10);
         if (!str) {
             JS_ReportOutOfMemory(cx);
             return false;
         }
         args.rval().setString(str);
         return true;
     }
     int precision;
     if (!ComputePrecisionInRange(cx, 1, MAX_PRECISION, args[0], &precision))
         return false;
     return DToStrResult(cx, d, DTOSTR_PRECISION, precision, args);
 }
 static bool
 num_toPrecision(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_toPrecision_impl>(cx, args);
 }
 static const JSFunctionSpec number_methods[] = {
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str,       num_toSource,          0, 0),
 #endif
     JS_FN(js_toString_str,       js_num_toString,       1, 0),
 #if EXPOSE_INTL_API
     JS_SELF_HOSTED_FN(js_toLocaleString_str, "Number_toLocaleString", 0,0),
 #else
     JS_FN(js_toLocaleString_str, num_toLocaleString,     0,0),
 #endif
     JS_FN(js_valueOf_str,        js_num_valueOf,        0, 0),
     JS_FN("toFixed",             num_toFixed,           1, 0),
     JS_FN("toExponential",       num_toExponential,     1, 0),
     JS_FN("toPrecision",         num_toPrecision,       1, 0),
     JS_FS_END
 };
 // ES6 draft ES6 15.7.3.10
 static bool
 Number_isNaN(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() < 1 || !args[0].isDouble()) {
         args.rval().setBoolean(false);
         return true;
     }
     args.rval().setBoolean(mozilla::IsNaN(args[0].toDouble()));
     return true;
 }
 // ES6 draft ES6 15.7.3.11
 static bool
 Number_isFinite(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() < 1 || !args[0].isNumber()) {
         args.rval().setBoolean(false);
         return true;
     }
     args.rval().setBoolean(args[0].isInt32() ||
                            mozilla::IsFinite(args[0].toDouble()));
     return true;
 }
 // ES6 draft ES6 15.7.3.12
 static bool
 Number_isInteger(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() < 1 || !args[0].isNumber()) {
         args.rval().setBoolean(false);
         return true;
     }
     Value val = args[0];
     args.rval().setBoolean(val.isInt32() ||
                            (mozilla::IsFinite(val.toDouble()) &&
                             ToInteger(val.toDouble()) == val.toDouble()));
     return true;
 }
 // ES6 drafult ES6 15.7.3.13
 static bool
 Number_toInteger(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() < 1) {
         args.rval().setInt32(0);
         return true;
     }
     double asint;
     if (!ToInteger(cx, args[0], &asint))
         return false;
     args.rval().setNumber(asint);
     return true;
 }
 static const JSFunctionSpec number_static_methods[] = {
     JS_FN("isFinite", Number_isFinite, 1, 0),
     JS_FN("isInteger", Number_isInteger, 1, 0),
     JS_FN("isNaN", Number_isNaN, 1, 0),
     JS_FN("toInteger", Number_toInteger, 1, 0),
     /* ES6 additions. */
     JS_FN("parseFloat", num_parseFloat, 1, 0),
     JS_FN("parseInt", num_parseInt, 2, 0),
     JS_FS_END
 };
 /* NB: Keep this in synch with number_constants[]. */
 enum nc_slot {
     NC_NaN,
     NC_POSITIVE_INFINITY,
     NC_NEGATIVE_INFINITY,
     NC_MAX_VALUE,
     NC_MIN_VALUE,
     NC_MAX_SAFE_INTEGER,
     NC_MIN_SAFE_INTEGER,
     NC_EPSILON,
     NC_LIMIT
 };
 /*
  * Some to most C compilers forbid spelling these at compile time, or barf
  * if you try, so all but MAX_VALUE are set up by InitRuntimeNumberState
  * using union jsdpun.
  */
 static JSConstDoubleSpec number_constants[] = {
     {0,                         "NaN",               0,{0,0,0}},
     {0,                         "POSITIVE_INFINITY", 0,{0,0,0}},
     {0,                         "NEGATIVE_INFINITY", 0,{0,0,0}},
     {1.7976931348623157E+308,   "MAX_VALUE",         0,{0,0,0}},
     {0,                         "MIN_VALUE",         0,{0,0,0}},
     /* ES6 (April 2014 draft) 20.1.2.6 */
     {9007199254740991,          "MAX_SAFE_INTEGER",  0,{0,0,0}},
     /* ES6 (April 2014 draft) 20.1.2.10 */
     {-9007199254740991,         "MIN_SAFE_INTEGER",  0,{0,0,0}},
     /* ES6 (May 2013 draft) 15.7.3.7 */
     {2.2204460492503130808472633361816e-16, "EPSILON", 0,{0,0,0}},
     {0,0,0,{0,0,0}}
 };
 #if (defined __GNUC__ && defined __i386__) || \
     (defined __SUNPRO_CC && defined __i386)
 /*
  * Set the exception mask to mask all exceptions and set the FPU precision
  * to 53 bit mantissa (64 bit doubles).
  */
 static inline void FIX_FPU() {
     short control;
     asm("fstcw %0" : "=m" (control) : );
     control &= ~0x300; // Lower bits 8 and 9 (precision control).
     control |= 0x2f3;  // Raise bits 0-5 (exception masks) and 9 (64-bit precision).
     asm("fldcw %0" : : "m" (control) );
 }
 #else
 #define FIX_FPU() ((void)0)
 #endif
 bool
 js::InitRuntimeNumberState(JSRuntime *rt)
 {
     FIX_FPU();
     /*
      * Our NaN must be one particular canonical value, because we rely on NaN
      * encoding for our value representation.  See Value.h.
      */
     number_constants[NC_NaN].dval = GenericNaN();
     number_constants[NC_POSITIVE_INFINITY].dval = mozilla::PositiveInfinity<double>();
     number_constants[NC_NEGATIVE_INFINITY].dval = mozilla::NegativeInfinity<double>();
     number_constants[NC_MIN_VALUE].dval = MinNumberValue<double>();
     // XXX If EXPOSE_INTL_API becomes true all the time at some point,
     //     js::InitRuntimeNumberState is no longer fallible, and we should
     //     change its return type.
 #if !EXPOSE_INTL_API
     /* Copy locale-specific separators into the runtime strings. */
     const char *thousandsSeparator, *decimalPoint, *grouping;
 #ifdef HAVE_LOCALECONV
     struct lconv *locale = localeconv();
     thousandsSeparator = locale->thousands_sep;
     decimalPoint = locale->decimal_point;
     grouping = locale->grouping;
 #else
     thousandsSeparator = getenv("LOCALE_THOUSANDS_SEP");
     decimalPoint = getenv("LOCALE_DECIMAL_POINT");
     grouping = getenv("LOCALE_GROUPING");
 #endif
     if (!thousandsSeparator)
         thousandsSeparator = "'";
     if (!decimalPoint)
         decimalPoint = ".";
     if (!grouping)
         grouping = "\3\0";
     /*
      * We use single malloc to get the memory for all separator and grouping
      * strings.
      */
     size_t thousandsSeparatorSize = strlen(thousandsSeparator) + 1;
     size_t decimalPointSize = strlen(decimalPoint) + 1;
     size_t groupingSize = strlen(grouping) + 1;
     char *storage = js_pod_malloc<char>(thousandsSeparatorSize +
                                         decimalPointSize +
                                         groupingSize);
     if (!storage)
         return false;
     js_memcpy(storage, thousandsSeparator, thousandsSeparatorSize);
     rt->thousandsSeparator = storage;
     storage += thousandsSeparatorSize;
     js_memcpy(storage, decimalPoint, decimalPointSize);
     rt->decimalSeparator = storage;
     storage += decimalPointSize;
     js_memcpy(storage, grouping, groupingSize);
     rt->numGrouping = grouping;
 #endif /* !EXPOSE_INTL_API */
     return true;
 }
 #if !EXPOSE_INTL_API
 void
 js::FinishRuntimeNumberState(JSRuntime *rt)
 {
     /*
      * The free also releases the memory for decimalSeparator and numGrouping
      * strings.
      */
     char *storage = const_cast<char *>(rt->thousandsSeparator);
     js_free(storage);
 }
 #endif
 JSObject *
 js_InitNumberClass(JSContext *cx, HandleObject obj)
 {
     JS_ASSERT(obj->isNative());
     /* XXX must do at least once per new thread, so do it per JSContext... */
     FIX_FPU();
     Rooted<GlobalObject*> global(cx, &obj->as<GlobalObject>());
     RootedObject numberProto(cx, global->createBlankPrototype(cx, &NumberObject::class_));
     if (!numberProto)
         return nullptr;
     numberProto->as<NumberObject>().setPrimitiveValue(0);
     RootedFunction ctor(cx);
     ctor = global->createConstructor(cx, Number, cx->names().Number, 1);
     if (!ctor)
         return nullptr;
     if (!LinkConstructorAndPrototype(cx, ctor, numberProto))
         return nullptr;
     /* Add numeric constants (MAX_VALUE, NaN, &c.) to the Number constructor. */
     if (!JS_DefineConstDoubles(cx, ctor, number_constants))
         return nullptr;
     if (!DefinePropertiesAndBrand(cx, ctor, nullptr, number_static_methods))
         return nullptr;
     if (!DefinePropertiesAndBrand(cx, numberProto, nullptr, number_methods))
         return nullptr;
     if (!JS_DefineFunctions(cx, global, number_functions))
         return nullptr;
     RootedValue valueNaN(cx, cx->runtime()->NaNValue);
     RootedValue valueInfinity(cx, cx->runtime()->positiveInfinityValue);
     /* ES5 15.1.1.1, 15.1.1.2 */
     if (!DefineNativeProperty(cx, global, cx->names().NaN, valueNaN,
                               JS_PropertyStub, JS_StrictPropertyStub,
                               JSPROP_PERMANENT | JSPROP_READONLY) ||
         !DefineNativeProperty(cx, global, cx->names().Infinity, valueInfinity,
                               JS_PropertyStub, JS_StrictPropertyStub,
                               JSPROP_PERMANENT | JSPROP_READONLY))
     {
         return nullptr;
     }
     if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_Number, ctor, numberProto))
         return nullptr;
     return numberProto;
 }
 static char *
 FracNumberToCString(ThreadSafeContext *cx, ToCStringBuf *cbuf, double d, int base = 10)
 {
 #ifdef DEBUG
     {
         int32_t _;
         JS_ASSERT(!mozilla::NumberIsInt32(d, &_));
     }
 #endif
     char* numStr;
     if (base == 10) {
         /*
          * This is V8's implementation of the algorithm described in the
          * following paper:
          *
          *   Printing floating-point numbers quickly and accurately with integers.
          *   Florian Loitsch, PLDI 2010.
          */
         const double_conversion::DoubleToStringConverter &converter
             = double_conversion::DoubleToStringConverter::EcmaScriptConverter();
         double_conversion::StringBuilder builder(cbuf->sbuf, cbuf->sbufSize);
         converter.ToShortest(d, &builder);
         numStr = builder.Finalize();
     } else {
         numStr = cbuf->dbuf = js_dtobasestr(cx->dtoaState(), base, d);
     }
     return numStr;
 }
 char *
 js::NumberToCString(JSContext *cx, ToCStringBuf *cbuf, double d, int base/* = 10*/)
 {
     int32_t i;
     size_t len;
     return mozilla::NumberIsInt32(d, &i)
            ? Int32ToCString(cbuf, i, &len, base)
            : FracNumberToCString(cx, cbuf, d, base);
 }
 template <AllowGC allowGC>
 static JSString * JS_FASTCALL
 js_NumberToStringWithBase(ThreadSafeContext *cx, double d, int base)
 {
     ToCStringBuf cbuf;
     char *numStr;
     /*
      * Caller is responsible for error reporting. When called from trace,
      * returning nullptr here will cause us to fall of trace and then retry
      * from the interpreter (which will report the error).
      */
     if (base < 2 || base > 36)
         return nullptr;
     JSCompartment *comp = cx->isExclusiveContext()
                           ? cx->asExclusiveContext()->compartment()
                           : nullptr;
     int32_t i;
     if (mozilla::NumberIsInt32(d, &i)) {
         if (base == 10 && StaticStrings::hasInt(i))
             return cx->staticStrings().getInt(i);
         if (unsigned(i) < unsigned(base)) {
             if (i < 10)
                 return cx->staticStrings().getInt(i);
             jschar c = 'a' + i - 10;
             JS_ASSERT(StaticStrings::hasUnit(c));
             return cx->staticStrings().getUnit(c);
         }
         if (comp) {
             if (JSFlatString *str = comp->dtoaCache.lookup(base, d))
                 return str;
         }
         size_t len;
         numStr = Int32ToCString(&cbuf, i, &len, base);
         JS_ASSERT(!cbuf.dbuf && numStr >= cbuf.sbuf && numStr < cbuf.sbuf + cbuf.sbufSize);
     } else {
         if (comp) {
             if (JSFlatString *str = comp->dtoaCache.lookup(base, d))
                 return str;
         }
         numStr = FracNumberToCString(cx, &cbuf, d, base);
         if (!numStr) {
             js_ReportOutOfMemory(cx);
             return nullptr;
         }
         JS_ASSERT_IF(base == 10,
                      !cbuf.dbuf && numStr >= cbuf.sbuf && numStr < cbuf.sbuf + cbuf.sbufSize);
         JS_ASSERT_IF(base != 10,
                      cbuf.dbuf && cbuf.dbuf == numStr);
     }
     JSFlatString *s = js_NewStringCopyZ<allowGC>(cx, numStr);
     if (comp)
         comp->dtoaCache.cache(base, d, s);
     return s;
 }
 template <AllowGC allowGC>
 JSString *
 js::NumberToString(ThreadSafeContext *cx, double d)
 {
     return js_NumberToStringWithBase<allowGC>(cx, d, 10);
 }
 template JSString *
 js::NumberToString<CanGC>(ThreadSafeContext *cx, double d);
 template JSString *
 js::NumberToString<NoGC>(ThreadSafeContext *cx, double d);
 JSAtom *
 js::NumberToAtom(ExclusiveContext *cx, double d)
 {
     int32_t si;
     if (mozilla::NumberIsInt32(d, &si))
         return Int32ToAtom(cx, si);
     if (JSFlatString *str = LookupDtoaCache(cx, d))
         return AtomizeString(cx, str);
     ToCStringBuf cbuf;
     char *numStr = FracNumberToCString(cx, &cbuf, d);
     if (!numStr) {
         js_ReportOutOfMemory(cx);
         return nullptr;
     }
     JS_ASSERT(!cbuf.dbuf && numStr >= cbuf.sbuf && numStr < cbuf.sbuf + cbuf.sbufSize);
     size_t length = strlen(numStr);
     JSAtom *atom = Atomize(cx, numStr, length);
     if (!atom)
         return nullptr;
     CacheNumber(cx, d, atom);
     return atom;
 }
 JSFlatString *
 js::NumberToString(JSContext *cx, double d)
 {
     if (JSString *str = js_NumberToStringWithBase<CanGC>(cx, d, 10))
         return &str->asFlat();
     return nullptr;
 }
 JSFlatString *
 js::IndexToString(JSContext *cx, uint32_t index)
 {
     if (StaticStrings::hasUint(index))
         return cx->staticStrings().getUint(index);
     JSCompartment *c = cx->compartment();
     if (JSFlatString *str = c->dtoaCache.lookup(10, index))
         return str;
     JSFatInlineString *str = js_NewGCFatInlineString<CanGC>(cx);
     if (!str)
         return nullptr;
     jschar buffer[JSFatInlineString::MAX_FAT_INLINE_LENGTH + 1];
     RangedPtr<jschar> end(buffer + JSFatInlineString::MAX_FAT_INLINE_LENGTH,
                           buffer, JSFatInlineString::MAX_FAT_INLINE_LENGTH + 1);
     *end = '\0';
     RangedPtr<jschar> start = BackfillIndexInCharBuffer(index, end);
     jschar *dst = str->init(end - start);
     PodCopy(dst, start.get(), end - start + 1);
     c->dtoaCache.cache(10, index, str);
     return str;
 }
 bool JS_FASTCALL
 js::NumberValueToStringBuffer(JSContext *cx, const Value &v, StringBuffer &sb)
 {
     /* Convert to C-string. */
     ToCStringBuf cbuf;
     const char *cstr;
     size_t cstrlen;
     if (v.isInt32()) {
         cstr = Int32ToCString(&cbuf, v.toInt32(), &cstrlen);
         JS_ASSERT(cstrlen == strlen(cstr));
     } else {
         cstr = NumberToCString(cx, &cbuf, v.toDouble());
         if (!cstr) {
             JS_ReportOutOfMemory(cx);
             return false;
         }
         cstrlen = strlen(cstr);
     }
     /*
      * Inflate to jschar string.  The input C-string characters are < 127, so
      * even if jschars are UTF-8, all chars should map to one jschar.
      */
     JS_ASSERT(!cbuf.dbuf && cstrlen < cbuf.sbufSize);
     return sb.appendInflated(cstr, cstrlen);
 }
 static bool
 CharsToNumber(ThreadSafeContext *cx, const jschar *chars, size_t length, double *result)
 {
     if (length == 1) {
         jschar c = chars[0];
         if ('0' <= c && c <= '9')
             *result = c - '0';
         else if (unicode::IsSpace(c))
             *result = 0.0;
         else
             *result = GenericNaN();
         return true;
     }
     const jschar *end = chars + length;
     const jschar *bp = SkipSpace(chars, end);
     /* ECMA doesn't allow signed hex numbers (bug 273467). */
     if (end - bp >= 2 && bp[0] == '0' && (bp[1] == 'x' || bp[1] == 'X')) {
         /*
          * It's probably a hex number.  Accept if there's at least one hex
          * digit after the 0x, and if no non-whitespace characters follow all
          * the hex digits.
          */
         const jschar *endptr;
         double d;
         if (!GetPrefixInteger(cx, bp + 2, end, 16, &endptr, &d) ||
             endptr == bp + 2 ||
             SkipSpace(endptr, end) != end)
         {
             *result = GenericNaN();
         } else {
             *result = d;
         }
         return true;
     }
     /*
      * Note that ECMA doesn't treat a string beginning with a '0' as
      * an octal number here. This works because all such numbers will
      * be interpreted as decimal by js_strtod.  Also, any hex numbers
      * that have made it here (which can only be negative ones) will
      * be treated as 0 without consuming the 'x' by js_strtod.
      */
     const jschar *ep;
     double d;
     if (!js_strtod(cx, bp, end, &ep, &d)) {
         *result = GenericNaN();
         return false;
     }
     if (SkipSpace(ep, end) != end)
         *result = GenericNaN();
     else
         *result = d;
     return true;
 }
 bool
 js::StringToNumber(ThreadSafeContext *cx, JSString *str, double *result)
 {
     ScopedThreadSafeStringInspector inspector(str);
     if (!inspector.ensureChars(cx))
         return false;
     return CharsToNumber(cx, inspector.chars(), str->length(), result);
 }
 bool
 js::NonObjectToNumberSlow(ThreadSafeContext *cx, Value v, double *out)
 {
     JS_ASSERT(!v.isNumber());
     JS_ASSERT(!v.isObject());
     if (v.isString())
         return StringToNumber(cx, v.toString(), out);
     if (v.isBoolean()) {
         *out = v.toBoolean() ? 1.0 : 0.0;
         return true;
     }
     if (v.isNull()) {
         *out = 0.0;
         return true;
     }
     JS_ASSERT(v.isUndefined());
     *out = GenericNaN();
     return true;
 }
 #if defined(_MSC_VER)
 # pragma optimize("g", off)
 #endif
 bool
 js::ToNumberSlow(ExclusiveContext *cx, Value v, double *out)
 {
     JS_ASSERT(!v.isNumber());
     goto skip_int_double;
     for (;;) {
         if (v.isNumber()) {
             *out = v.toNumber();
             return true;
         }
       skip_int_double:
         if (!v.isObject())
             return NonObjectToNumberSlow(cx, v, out);
         if (!cx->isJSContext())
             return false;
         RootedValue v2(cx, v);
         if (!ToPrimitive(cx->asJSContext(), JSTYPE_NUMBER, &v2))
             return false;
         v = v2;
         if (v.isObject())
             break;
     }
     *out = GenericNaN();
     return true;
 }
 JS_PUBLIC_API(bool)
 js::ToNumberSlow(JSContext *cx, Value v, double *out)
 {
     return ToNumberSlow(static_cast<ExclusiveContext *>(cx), v, out);
 }
 #if defined(_MSC_VER)
 # pragma optimize("", on)
 #endif
 /*
  * Convert a value to an int64_t, according to the WebIDL rules for long long
  * conversion. Return converted value in *out on success, false on failure.
  */
 JS_PUBLIC_API(bool)
 js::ToInt64Slow(JSContext *cx, const HandleValue v, int64_t *out)
 {
     JS_ASSERT(!v.isInt32());
     double d;
     if (v.isDouble()) {
         d = v.toDouble();
     } else {
         if (!ToNumberSlow(cx, v, &d))
             return false;
     }
     *out = ToInt64(d);
     return true;
 }
 /*
  * Convert a value to an uint64_t, according to the WebIDL rules for unsigned long long
  * conversion. Return converted value in *out on success, false on failure.
  */
 JS_PUBLIC_API(bool)
 js::ToUint64Slow(JSContext *cx, const HandleValue v, uint64_t *out)
 {
     JS_ASSERT(!v.isInt32());
     double d;
     if (v.isDouble()) {
         d = v.toDouble();
     } else {
         if (!ToNumberSlow(cx, v, &d))
             return false;
     }
     *out = ToUint64(d);
     return true;
 }
 template <typename ContextType,
           bool (*ToNumberSlowFn)(ContextType *, Value, double *),
           typename ValueType>
 static bool
 ToInt32SlowImpl(ContextType *cx, const ValueType v, int32_t *out)
 {
     JS_ASSERT(!v.isInt32());
     double d;
     if (v.isDouble()) {
         d = v.toDouble();
     } else {
         if (!ToNumberSlowFn(cx, v, &d))
             return false;
     }
     *out = ToInt32(d);
     return true;
 }
 JS_PUBLIC_API(bool)
 js::ToInt32Slow(JSContext *cx, const HandleValue v, int32_t *out)
 {
     return ToInt32SlowImpl<JSContext, ToNumberSlow>(cx, v, out);
 }
 bool
 js::NonObjectToInt32Slow(ThreadSafeContext *cx, const Value &v, int32_t *out)
 {
     return ToInt32SlowImpl<ThreadSafeContext, NonObjectToNumberSlow>(cx, v, out);
 }
 template <typename ContextType,
           bool (*ToNumberSlowFn)(ContextType *, Value, double *),
           typename ValueType>
 static bool
 ToUint32SlowImpl(ContextType *cx, const ValueType v, uint32_t *out)
 {
     JS_ASSERT(!v.isInt32());
     double d;
     if (v.isDouble()) {
         d = v.toDouble();
     } else {
         if (!ToNumberSlowFn(cx, v, &d))
             return false;
     }
     *out = ToUint32(d);
     return true;
 }
 JS_PUBLIC_API(bool)
 js::ToUint32Slow(JSContext *cx, const HandleValue v, uint32_t *out)
 {
     return ToUint32SlowImpl<JSContext, ToNumberSlow>(cx, v, out);
 }
 bool
 js::NonObjectToUint32Slow(ThreadSafeContext *cx, const Value &v, uint32_t *out)
 {
     return ToUint32SlowImpl<ThreadSafeContext, NonObjectToNumberSlow>(cx, v, out);
 }
 JS_PUBLIC_API(bool)
 js::ToUint16Slow(JSContext *cx, const HandleValue v, uint16_t *out)
 {
     JS_ASSERT(!v.isInt32());
     double d;
     if (v.isDouble()) {
         d = v.toDouble();
     } else if (!ToNumberSlow(cx, v, &d)) {
         return false;
     }
     if (d == 0 || !mozilla::IsFinite(d)) {
         *out = 0;
         return true;
     }
     uint16_t u = (uint16_t) d;
     if ((double)u == d) {
         *out = u;
         return true;
     }
     bool neg = (d < 0);
     d = floor(neg ? -d : d);
     d = neg ? -d : d;
     unsigned m = JS_BIT(16);
     d = fmod(d, (double) m);
     if (d < 0)
         d += m;
     *out = (uint16_t) d;
     return true;
 }
 bool
 js_strtod(ThreadSafeContext *cx, const jschar *s, const jschar *send,
           const jschar **ep, double *dp)
 {
     size_t i;
     char cbuf[32];
     char *cstr, *istr, *estr;
     bool negative;
     double d;
     const jschar *s1 = SkipSpace(s, send);
     size_t length = send - s1;
     /* Use cbuf to avoid malloc */
     if (length >= sizeof cbuf) {
         cstr = (char *) cx->malloc_(length + 1);
         if (!cstr)
            return false;
     } else {
         cstr = cbuf;
     }
     for (i = 0; i != length; i++) {
         if (s1[i] >> 8)
             break;
         cstr[i] = (char)s1[i];
     }
     cstr[i] = 0;
     istr = cstr;
     if ((negative = (*istr == '-')) != 0 || *istr == '+')
         istr++;
     if (*istr == 'I' && !strncmp(istr, "Infinity", 8)) {
         d = negative ? NegativeInfinity<double>() : PositiveInfinity<double>();
         estr = istr + 8;
     } else {
         int err;
         d = js_strtod_harder(cx->dtoaState(), cstr, &estr, &err);
     }
     i = estr - cstr;
     if (cstr != cbuf)
         js_free(cstr);
     *ep = i ? s1 + i : s;
     *dp = d;
     return true;
 }

The Tor Browser / annotate

js/src/jsnum.cpp@6474c204b198 (annotated)

js/src/jsnum.cpp