From 11818f1cb059d023534f7bf5e1605d6c98aee45d Mon Sep 17 00:00:00 2001
From: Daniella Barsony <bella@inf.u-szeged.hu>
Date: Tue, 29 Oct 2019 08:35:55 +0100
Subject: [PATCH] Fix issue about Number.prototype.toString (#3232)

Fixes #3229

JerryScript-DCO-1.0-Signed-off-by: Daniella Barsony bella@inf.u-szeged.hu
---
 .../ecma-builtin-number-prototype.c           | 44 +++++++++----------
 tests/jerry/regression-test-issue-3229.js     | 33 ++++++++++++++
 2 files changed, 53 insertions(+), 24 deletions(-)
 create mode 100644 tests/jerry/regression-test-issue-3229.js

diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.c b/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.c
index 16dfb2e7c..2fb30e19d 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.c
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.c
@@ -249,16 +249,6 @@ ecma_builtin_number_prototype_object_to_string (ecma_number_t this_arg_number, /
                                                 const ecma_value_t *arguments_list_p, /**< arguments list */
                                                 ecma_length_t arguments_list_len) /**< number of arguments */
 {
-
-  if (arguments_list_len == 0
-      || ecma_number_is_nan (this_arg_number)
-      || ecma_number_is_infinity (this_arg_number)
-      || ecma_number_is_zero (this_arg_number)
-      || (arguments_list_len > 0 && ecma_is_value_undefined (arguments_list_p[0])))
-  {
-    ecma_string_t *ret_str_p = ecma_new_ecma_string_from_number (this_arg_number);
-    return ecma_make_string_value (ret_str_p);
-  }
   static const lit_utf8_byte_t digit_chars[36] =
   {
     '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
@@ -267,27 +257,33 @@ ecma_builtin_number_prototype_object_to_string (ecma_number_t this_arg_number, /
     'u', 'v', 'w', 'x', 'y', 'z'
   };
 
-  ecma_number_t arg_num;
-  ecma_value_t radix_num = ecma_get_number (arguments_list_p[0], &arg_num);
-
-  if (!ecma_is_value_empty (radix_num))
+  uint32_t radix = 10;
+  if (arguments_list_len > 0 && !ecma_is_value_undefined (arguments_list_p[0]))
   {
-    return radix_num;
+    ecma_number_t arg_num;
+
+    if (ECMA_IS_VALUE_ERROR (ecma_get_number (arguments_list_p[0], &arg_num)))
+    {
+      return ECMA_VALUE_ERROR;
+    }
+
+    radix = ecma_number_to_uint32 (arg_num);
+
+    if (radix < 2 || radix > 36)
+    {
+      return ecma_raise_range_error (ECMA_ERR_MSG ("Radix must be between 2 and 36."));
+    }
   }
 
-  uint32_t radix = ecma_number_to_uint32 (arg_num);
-
-  if (radix < 2 || radix > 36)
-  {
-    return ecma_raise_range_error (ECMA_ERR_MSG ("Radix must be between 2 and 36."));
-  }
-
-  if (radix == 10)
+  if (ecma_number_is_nan (this_arg_number)
+      || ecma_number_is_infinity (this_arg_number)
+      || ecma_number_is_zero (this_arg_number)
+      || radix == 10)
   {
     ecma_string_t *ret_str_p = ecma_new_ecma_string_from_number (this_arg_number);
-
     return ecma_make_string_value (ret_str_p);
   }
+
   int buff_size = 0;
 
   bool is_number_negative = false;
diff --git a/tests/jerry/regression-test-issue-3229.js b/tests/jerry/regression-test-issue-3229.js
new file mode 100644
index 000000000..50719181f
--- /dev/null
+++ b/tests/jerry/regression-test-issue-3229.js
@@ -0,0 +1,33 @@
+/* Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var NISLFuzzingFunc = function(e) {
+  Number(0).toString(e);
+};
+
+var NISLParameter4 = "Hello Jerry";
+
+try {
+  NISLFuzzingFunc(NISLParameter4);
+  assert(false);
+} catch (e) {
+  assert(e instanceof RangeError);
+}
+try {
+  Number.prototype.toString.call(-Infinity, "Unicorn invasion");
+  assert(false);
+} catch (e) {
+  assert(e instanceof RangeError);
+}