[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[ggaren at apple.com]

The following commit has been merged in the debian/experimental branch:
commit 95932c24107d0c00287db20cb8562e4bb74a373d
Author: ggaren at apple.com <ggaren at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Aug 5 04:52:25 2010 +0000

    JavaScriptCore: https://bugs.webkit.org/show_bug.cgi?id=43461
    Invalid NaN parsing
    
    Reviewed by Oliver Hunt and Beth Dakin.
    
    * wtf/dtoa.cpp: Turn off the dtoa feature that allows you to specify a
    non-standard NaN representation, since our NaN encoding assumes that all
    true NaNs have the standard bit pattern.
    
    * API/JSValueRef.cpp:
    (JSValueMakeNumber): Don't allow an API client to accidentally specify
    a non-standard NaN either.
    
    LayoutTests: https://bugs.webkit.org/show_bug.cgi?id=43461
    Crash parsing certain values for NaN
    
    Reviewed by Oliver Hunt and Beth Dakin.
    
    * fast/js/parse-nan.html: Added.
    * fast/js/script-tests/parse-nan.js: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@64706 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/API/JSValueRef.cpp b/JavaScriptCore/API/JSValueRef.cpp
index a29a207..c22e8d8 100644
--- a/JavaScriptCore/API/JSValueRef.cpp
+++ b/JavaScriptCore/API/JSValueRef.cpp
@@ -213,6 +213,12 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
     ExecState* exec = toJS(ctx);
     APIEntryShim entryShim(exec);
 
+    // Our JSValue representation relies on a standard bit pattern for NaN. NaNs
+    // generated internally to JavaScriptCore naturally have that representation,
+    // but an external NaN might not.
+    if (isnan(value))
+        value = NaN;
+
     return toRef(exec, jsNumber(exec, value));
 }
 
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 5c6d6c5..099f30b 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,18 @@
+2010-08-03  Geoffrey Garen  <ggaren at apple.com>
+
+        Reviewed by Oliver Hunt and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43461
+        Invalid NaN parsing
+        
+        * wtf/dtoa.cpp: Turn off the dtoa feature that allows you to specify a
+        non-standard NaN representation, since our NaN encoding assumes that all
+        true NaNs have the standard bit pattern.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber): Don't allow an API client to accidentally specify
+        a non-standard NaN either.
+
 2010-08-04  Gavin Barraclough  <barraclough at apple.com>
 
         Windows build fix part II.
diff --git a/JavaScriptCore/wtf/dtoa.cpp b/JavaScriptCore/wtf/dtoa.cpp
index 9edc2a0..2c478a0 100644
--- a/JavaScriptCore/wtf/dtoa.cpp
+++ b/JavaScriptCore/wtf/dtoa.cpp
@@ -167,6 +167,7 @@
 #endif
 
 #define INFNAN_CHECK
+#define No_Hex_NaN
 
 #if defined(IEEE_8087) + defined(IEEE_MC68k) + defined(IEEE_ARM) != 1
 Exactly one of IEEE_8087, IEEE_ARM or IEEE_MC68k should be defined.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index b39d396..5d5d96f 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-08-03  Geoffrey Garen  <ggaren at apple.com>
+
+        Reviewed by Oliver Hunt and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43461
+        Crash parsing certain values for NaN
+
+        * fast/js/parse-nan.html: Added.
+        * fast/js/script-tests/parse-nan.js: Added.
+
 2010-08-04  Sheriff Bot  <webkit.review.bot at gmail.com>
 
         Unreviewed, rolling out r64674.
diff --git a/LayoutTests/fast/js/parse-nan-expected.txt b/LayoutTests/fast/js/parse-nan-expected.txt
new file mode 100644
index 0000000..c752ab2
--- /dev/null
+++ b/LayoutTests/fast/js/parse-nan-expected.txt
@@ -0,0 +1,10 @@
+This test checks for a crash when parsing NaN. You should see the text 'NaN' below.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+NaN
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/js/parse-nan.html b/LayoutTests/fast/js/parse-nan.html
new file mode 100644
index 0000000..647906e
--- /dev/null
+++ b/LayoutTests/fast/js/parse-nan.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/parse-nan.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/js/script-tests/parse-nan.js b/LayoutTests/fast/js/script-tests/parse-nan.js
new file mode 100644
index 0000000..e6a79a0
--- /dev/null
+++ b/LayoutTests/fast/js/script-tests/parse-nan.js
@@ -0,0 +1,7 @@
+description(
+"This test checks for a crash when parsing NaN. You should see the text 'NaN' below."
+);
+
+debug(-parseFloat("NAN(ffffeeeeeff0f)"));
+
+var successfullyParsed = true;

-- 
WebKit Debian packaging